A memory corruption vulnerability in the Linux kernel TUN/TAP driver could allow a local attacker to achieve privilege escalation or system instability.

The vulnerability exists in the tun_get_user function, where an oversized headroom request can cause an integer underflow in SKB_MAX_HEAD. This leads to an incorrect calculation of linear buffer space, allowing skb data to be placed outside the allocated memory head when accessed by a local user with low privileges.

Successful exploitation of this vulnerability allows a local user to corrupt kernel memory, potentially leading to unauthorized privilege escalation or a system crash. Given the CVSS score of 7.8, this represents a significant risk to the integrity and availability of affected Linux systems, particularly in multi-tenant or containerized environments where local user isolation is critical.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary headroom bounding fixes.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual memory access errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to TUN/TAP device creation to trusted users only, as the attack vector requires local access to the system.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a high risk to systems utilizing TUN/TAP interfaces, such as those running Open vSwitch or container networking stacks. Administrators should prioritize patching their kernels to the specified fixed versions to prevent potential local privilege escalation. Immediate testing and deployment of these kernel updates are recommended to ensure system security.