diff --git a/src/network/netdev/tuntap.c b/src/network/netdev/tuntap.c
index 47c56cfd70..c97478b2a4 100644
--- a/src/network/netdev/tuntap.c
+++ b/src/network/netdev/tuntap.c
@@ -60,7 +60,7 @@ static int netdev_tuntap_add(NetDev *netdev, struct ifreq *ifr) {
         assert(netdev);
         assert(ifr);
 
-        fd = open(TUN_DEV, O_RDWR);
+        fd = open(TUN_DEV, O_RDWR|O_CLOEXEC);
         if (fd < 0)
                 return log_netdev_error_errno(netdev, -errno,  "Failed to open tun dev: %m");