TUN/TAP refers to two closely related Linux virtual network interfaces. TUN carries Layer 3 IP packets, while TAP carries Layer 2 Ethernet frames. They let user-space programs send packets into the kernel networking stack and receive packets back as if they were talking to a real network device.
This matters in security because TUN/TAP is widely used by VPNs, tunnels, sandboxes, and test tools, which means it expands the kernel’s reachable attack surface. Many operations require privileges such as CAP_NET_ADMIN or a user namespace, so mistakes in this code can become local privilege escalation paths. Defenders should keep kernels patched, limit unnecessary namespace and capability access, and disable TUN/TAP support where it is not needed.