geneve: require CAP_NET_ADMIN in the device netns for changelink
Summary
| CVE | CVE-2026-68142 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-08-10 13:19:59 UTC |
|---|
| Updated | 2026-08-10 13:19:59 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
geneve: require CAP_NET_ADMIN in the device netns for changelink
A tunnel changelink() operates on at most two netns, dev_net(dev) and
the sticky underlay netns geneve->net. They differ once the device is
created in or moved to a netns other than the one the request runs in.
The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),
so a caller privileged there but not in geneve->net can rewrite a geneve
device whose underlay lives in geneve->net.
geneve_changelink() applies the new configuration against geneve->net:
geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair
reopen the underlay sockets in that netns (geneve_sock_add() uses
geneve->net), so the same reasoning as the tunnel changelink series
applies here.
Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of
the op before any attribute is parsed, matching ipgre_changelink() and
the rest of the "require CAP_NET_ADMIN in the device netns for
changelink" series.
Found by 0sec automated security-research tooling (https://0sec.ai). |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a 2abdacc927c92fa6a9cc8341e8c9b88dcb561553 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a 9de5518fc1fab583526a8f66b8e505c4864dc60a git |
Not specified |
| CNA |
Linux |
Linux |
affected 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a f8c498585d2a08aa623748353c3e61467b7e9fd2 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a 95f45e20f1b2cec13823f0f68060ab4b2261b2c1 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a 8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4.14 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 4.14 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.148 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.101 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.42 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.6 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2-rc5 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/9de5518fc1fab583526a8f66b8e505c4864dc60a |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/95f45e20f1b2cec13823f0f68060ab4b2261b2c1 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f8c498585d2a08aa623748353c3e61467b7e9fd2 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/2abdacc927c92fa6a9cc8341e8c9b88dcb561553 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.