{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-63829", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.014Z", "datePublished": "2026-07-19T12:02:23.191Z", "dateUpdated": "2026-08-17T04:51:37.933Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:37.933Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t->net. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t->net can rewrite a tunnel that\nlives in t->net.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t->collect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/rtnetlink.h", "net/core/rtnetlink.c", "net/ipv4/ip_gre.c" ], "versions": [ { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "19275943d8fe903eb7b9aa53e380e41efd042ada", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "866b0f5ae599490bd496fd84581c68ac8b94e6af", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "92b766fc55156e0da2ecd0c2302c971118f8a229", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "e54c05ed3d9c28733fb9e5837219aca3691defa3", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "9831bc9ecb402957810c2045c663fbfe9b09e296", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "1697957eb0971d420dde42862b88eb43506a1105", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "47b5d3d506609b08b2e1f7c14f0b681a1953d572", "status": "affected", "versionType": "git" }, { "version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "8165f7ff57d9667d2bb477ef6af83ede7fed4ad7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/rtnetlink.h", "net/core/rtnetlink.c", "net/ipv4/ip_gre.c" ], "versions": [ { "version": "3.16", "status": "affected" }, { "version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.10.261" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.15.212" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.18.38" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.1.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada" }, { "url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af" }, { "url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229" }, { "url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3" }, { "url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296" }, { "url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105" }, { "url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572" }, { "url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7" } ], "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "x_generator": { "engine": "bippy-1.2.0" } } } }