The fault resides in the Linux kernel's net tun subsystem, where tun_get_user() misinterprets the tun->align field as both skb headroom and linear data length. When a port such as Open vSwitch forwards an oversized headroom request, the calculation of SKB_MAX_HEAD can underflow, causing a negative value for good_linear. That negative value later wraps into an unsigned size_t and instructs tun_alloc_skb() to place skb->data outside its allocated head region, corrupting kernel memory. This out‑of‑bounds write (CWE‑787) can be exploited for arbitrary kernel code execution or denial of service.

All Linux kernel releases containing the tun module before the patch that enforces a one‑page headroom budget are affected. The issue is present regardless of distribution or kernel version, as long as the vulnerable code paths remain active. No specific product or version list was provided, so any system running a kernel that has not yet received the change should be considered vulnerable.

The CVSS score of 6.4 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitability would require an attacker to influence the tun interface headroom value, typically through a privileged or compromised network service that interacts with TUN/TAP or via tools like Open vSwitch. Because the flaw leads to kernel memory corruption, successful exploitation could grant the attacker elevated privileges or cause a system crash. The lack of a public exploit suggests the immediate risk is moderate but non‑negligible in environments that load the tun module and accept open traffic over TUN/TAP.