net: tun: unlink NAPI from device on destruction

Kernel Updated 02 Oct 2025

Summary

31/07/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1004610: net: tun: unlink NAPI from device on destruction. Affects Kernel versions >= 943170998b200190f99d3fe7e771437e2c51f319, < bec1be0a745ab420718217e3e0d9542a75108989. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The net: tun package is a part of the Linux Kernel ecosystem. It provides a virtual network device that allows user-space programs to interact with the kernel networking stack. The tun device is commonly used for VPN implementations and network virtualization. This vulnerability affects versions of the Linux Kernel starting from v4.15 to v5.10.129. The vulnerability was introduced in v4.15 and fixed in v5.10.129.

Vulnerability Detail

The vulnerability in net: tun arises from the failure to unlink NAPI (New API) from the device during destruction. NAPI is a mechanism in the Linux Kernel that improves network performance by reducing CPU overhead. When the tun device is destroyed, NAPI should be unlinked from the device to prevent potential use-after-free vulnerabilities. However, due to the missing unlink operation, an attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The net: tun package in the Linux Kernel is vulnerable to a potential use-after-free vulnerability due to the failure to unlink NAPI from the device during destruction. Updating the kernel to version v5.10.129 or later will fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →