CVE-2026-99281: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99281 is a Linux kernel privilege escalation vulnerability in the TUN/TAP device subsystem, classified as an Incorrect Default Permissions flaw (CWE-276). The vulnerability stems from a missing CAP_NET_ADMIN capability check when unprivileged users attempt to attach to persistent TUN/TAP devices that have no explicitly assigned owner or group. It affects the Linux kernel from version 2.6.18 onward, with fixes available in stable commits targeting kernel branches up to 7.3.x and 7.4-rc1. It was published on November 7, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-276 (Incorrect Default Permissions): when /dev/net/tun permissions were relaxed to 0666 to allow TUNSETOWNER-assigned device owners to access their devices, persistent TUN/TAP devices with no owner or group set became world-attachable — any process that could open the device node could attach to them without CAP_NET_ADMIN. This oversight was compounded by the 2012 multiqueue support commit (c8d68e6be1c3), which introduced a race window between device creation and owner assignment. A prior fix attempt (commit 3ca459eaba1bf) was reverted due to an SELinux test suite regression, leaving the flaw unaddressed until the current patch, which enforces CAP_NET_ADMIN specifically for ownerless devices while preserving the existing ownership model for devices with an assigned owner or group (GitHub Advisory).

A local unprivileged user with access to /dev/net/tun can attach to any persistent TUN/TAP device that has no owner or group configured, enabling them to intercept and inject arbitrary network packets on that virtual interface. This can facilitate man-in-the-middle attacks against traffic traversing the affected network device, potentially exposing sensitive data or enabling further lateral movement within the network. The confidentiality, integrity, and availability impacts are all rated High, as an attacker gains full read/write access to the network stream of the affected device (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability requires local access to the system and the ability to open /dev/net/tun, limiting the attack surface to authenticated local users or processes. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS score data is not yet available for this CVE.

1. Reconnaissance: Identify a target Linux system running a kernel version from 2.6.18 up to the patched versions, with /dev/net/tun accessible (permissions 0666 or readable by the attacker's user).
2. Identify ownerless TUN/TAP devices: Enumerate persistent TUN/TAP interfaces using ip link show or cat /proc/net/dev and check whether any lack an assigned owner/group (e.g., created with ip tuntap add without a subsequent TUNSETOWNER/TUNSETGROUP ioctl).
3. Open the device node: As an unprivileged user, open /dev/net/tun — this succeeds because the device node is world-readable/writable.
4. Attach to the ownerless device: Issue the TUNSETIFF ioctl with the name of the target ownerless TUN/TAP interface. Without the patch, the kernel skips the CAP_NET_ADMIN check for ownerless devices and allows the attachment.
5. Intercept/inject packets: With the file descriptor now attached to the TUN/TAP device, read from it to capture network packets traversing the interface, or write crafted packets to inject traffic — enabling man-in-the-middle attacks or traffic manipulation (GitHub Advisory).

• Process: Unprivileged processes (non-root, lacking CAP_NET_ADMIN) holding open file descriptors to /dev/net/tun; visible via lsof /dev/net/tun or ls -l /proc/<pid>/fd.
• Network: Unexpected traffic patterns or duplicate packets on TUN/TAP interfaces; unusual processes listed as the queue owner of a TUN/TAP device in /sys/class/net/<iface>/.
• Logs: Kernel audit logs (auditd) showing open() or ioctl(TUNSETIFF) calls on /dev/net/tun by non-privileged UIDs without CAP_NET_ADMIN; check /var/log/audit/audit.log for comm entries referencing unexpected binaries accessing the tun device.
• File System: Presence of scripts or binaries in user-writable directories designed to open /dev/net/tun and issue TUNSETIFF ioctls.

Apply the Linux kernel patch that enforces CAP_NET_ADMIN for attaching to ownerless TUN/TAP devices; the fix is available in stable commits 2f92c0286cfd, e53d1cf05da8, and ffdf678dd166, targeting kernel branches through 6.18.61, 7.3.2, and 7.4-rc1 respectively (GitHub Advisory). As interim workarounds: (1) ensure all persistent TUN/TAP devices have an explicit owner assigned via TUNSETOWNER and/or TUNSETGROUP ioctls immediately after creation; (2) restrict access to /dev/net/tun via filesystem permissions (e.g., chmod 660 with a trusted group) to prevent unprivileged users from opening the device node; (3) use SELinux or AppArmor policies to limit which processes may open /dev/net/tun (Red Hat).

Red Hat has acknowledged the vulnerability and assigned it a Bugzilla entry (BZ#2568628), rating it Medium severity (Red Hat). The kernel maintainer's commit message provides detailed historical context, noting that the flaw existed for approximately 20 years and that a prior fix attempt was reverted due to an SELinux test suite regression — which was itself subsequently corrected in the SELinux test suite before the kernel fix was reapplied (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the kernel mailing list announcement has been observed at this time (Kernel Announce).