CVE-2026-52940

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tun: zero the whole vnet header in tun_put_user()<br /> <br /> tun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel<br /> without zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb()<br /> only initializes the first 10 bytes (sizeof(struct virtio_net_hdr)),<br /> leaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack<br /> garbage.<br /> <br /> An unprivileged user can set the vnet header size to 24 with<br /> TUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the<br /> partially-initialized struct to userspace, leaking 14 bytes of kernel<br /> stack on every read of a non-tunnel packet.<br /> <br /> Fix it the same way tun_get_user() already does by zeroing the whole<br /> header right after declaration.