CVE-2024-41091

What it actually does

Missing length validation in tun_xdp_one() allows frames shorter than ETH_HLEN to reach eth_type_trans() and downstream skb processing, producing corrupted skb metadata that can trigger out-of-bounds memory access or inconsistent header handling.

Why it matters to the business

Systems relying on TUN/TAP interfaces for containers, VMs, or VPNs face elevated risk of kernel panics, network instability, or potential local privilege escalation, increasing downtime and patching burden across Linux fleets.

How an attack unfolds

An attacker with access to a TUN device transmits a deliberately short Ethernet frame; the XDP fast-path omits the length guard present in tun_get_user(), causing eth_type_trans to read past the buffer and a malformed skb to be forwarded, resulting in memory corruption or crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 32b0aaba5dbc85816898167d9b5d45a22eae82e9, which adds an explicit frame-length check in tun_xdp_one identical to the existing check in tun_get_user(). Rebuild and reboot affected hosts; verify the patch is present via git log or kernel version string.

How to confirm the fix worked

Confirm the presence of the length guard (skb->len < ETH_HLEN) inside tun_xdp_one(); run regression tests that attempt to inject short frames and verify they are dropped without corrupting skb metadata.

Typical attack path

1. Obtain write access to a TUN/TAP character device
2. Craft and inject an Ethernet frame shorter than ETH_HLEN
3. Invoke tun_xdp_one processing path
4. Trigger eth_type_trans on undersized buffer
5. Observe kernel oops, panic, or downstream driver misbehavior

How to detect it

Search kernel logs and audit trails for tun_xdp_one stack traces, skb corruption warnings, or out-of-bounds accesses originating from the TUN driver; correlate with processes opening /dev/net/tun.

What your security team should do

• Prioritize kernel updates on any host exposing TUN/TAP devices to untrusted workloads
• Apply compensating controls such as SELinux or AppArmor policies that restrict TUN device access
• Monitor kernel logs for tun-related skb corruption warnings until patches are deployed