CVE-2018-7191: In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_n...

Security readout for executives and security teams

CVE-2018-7191 is a Linux kernel denial-of-service issue in the tun subsystem. A local user can trigger a kernel NULL pointer dereference and panic using a malformed TUN/TAP interface name. The business impact is host instability or outage, not documented data theft or remote compromise. Exposure is most relevant on Linux systems running kernels before 4.13.14 or downstream kernels without the vendor backport. Sources support local-user exploitation only. The bundle does not provide complete vendor, product, package, or distribution version mapping. Treat this as a patching and availability risk. It is not documented as remotely exploitable, but affected multi-user Linux systems could be crashed by a local user. Prioritize internet-facing production hosts, shared compute, and systems with untrusted shell users. Mitigation focus: Update to Linux kernel 4.13.14 or a vendor kernel containing the referenced fixes.; Check Ubuntu, SUSE, and other vendor advisories for backported kernel package status.; Prioritize shared servers where untrusted local users can access TUN/TAP functionality..

Prepared

Jun 6, 2026, 20:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.