{"vulnerability": "cve-2026-81000", "sightings": [{"uuid": "c4dd37dd-d896-4cd7-936c-d1e54a00ac4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117255479208869871", "content": "CVE-2026-81000: Linux kernel TUN driver HIGH severity vulnerability fixed. Flaw in skb headroom calculation could trigger memory corruption. Update to patched kernel ASAP. \ud83d\udc27 https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-net-tun-bound-receive-headroom-683cedae073ef3c4 #OffSeq #Linux #Vulnerability #BlueTeam", "creation_timestamp": "2026-09-12T01:30:24.363245Z"}, {"uuid": "e4fb727c-f52f-4c31-bc9e-f963dfa6289b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvbwmmuy522h", "content": "Linux kernel TUN driver HIGH severity vuln (CVE-2026-81000) now fixed. Issue could cause memory corruption via skb buffer misplacement. Update to patched kernel. \ud83d\udee1\ufe0f https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-net-tun-bound-receive-headroom-683...", "creation_timestamp": "2026-09-12T01:30:26.830701Z"}, {"uuid": "93199156-6ae3-4550-96c6-8213250bbe4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117284734249845885", "content": "CVE-2026-81000 Linux kernel tun driver integer underflow in tun_get_user() via oversized headroom from OVS, leading to memory corruption. No CVSS assigned, patch status unpatched. Apply kernel updates now. https://www.valtersit.com/cve/CVE-2026-81000/ #CVE #Linux #infosec", "creation_timestamp": "2026-09-17T05:30:26.950481Z"}, {"uuid": "4db2959e-9ad0-4911-8a5d-181805eb8ec4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mvowerl7mg2p", "content": "CVE-2026-81000 Linux kernel tun driver integer underflow in tun_get_user() via oversized headroom from OVS, leading to memory corruption. No CVSS assigned, patch status unpatched. Apply kernel updates now. https://www.valtersit.com/cve/CVE-2026-81000/ #CVE #Linux #infosec", "creation_timestamp": "2026-09-17T05:30:39.151716Z"}, {"uuid": "70f7d450-fadb-46c1-938f-e84b03e2f13b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:42.032867Z"}, {"uuid": "8236d7d3-ff32-42d4-93ce-524d7398f97b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81000", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47  https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:08.317072Z"}]}