CVE-2026-99281
Description
A flaw was found in the Linux kernel's TUN/TAP virtual network device driver. Persistent network devices created without an assigned owner or group failed to enforce administrative privilege checks when users attached to them. A local unprivileged attacker could exploit this vulnerability by opening the network device interface and attaching to an unassigned device, allowing them to intercept or transmit unauthorized network traffic.
Statement
Red Hat rates this vulnerability as an Important impact because unprivileged local users can attach to persistent TUN/TAP interfaces lacking assigned ownership, compromising the confidentiality and integrity of network traffic passing through the device. On standard Red Hat Enterprise Linux systems, the /dev/net/tun device node is accessible to local users to facilitate virtualization and container workflows. While exploitation requires local access and the presence of unowned persistent interfaces, the missing CAP_NET_ADMIN check permits arbitrary packet snooping and injection across these network devices.
Mitigation
If TUN/TAP virtual network devices are not required on the system, prevent the `tun` kernel module from loading:
1. Create a configuration file to blacklist the module:
# echo "install tun /bin/true" > /etc/modprobe.d/disable-tun.conf
# echo "blacklist tun" >> /etc/modprobe.d/disable-tun.conf
2. Unload the module if it is not currently active:
# modprobe -r tun
Alternatively, if TUN/TAP devices are required by the environment, ensure that all persistent interfaces are created with explicit owner and group assignments:
# ip tuntap add dev <interface_name> mode <tun|tap> user <username> group <groupname>
Caveats:
Disabling the `tun` module will disrupt virtual private network (VPN) daemons, virtualization hypervisors (such as QEMU/KVM), and container networking plugins that depend on TUN/TAP interfaces. If the module cannot be unloaded immediately because it is currently in use, a system reboot is required for the blacklisting configuration to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
