{"api_version":"1","generated_at":"2026-06-28T23:04:47+00:00","cve":"CVE-2026-53075","urls":{"html":"https://cve.report/CVE-2026-53075","api":"https://cve.report/api/cve/CVE-2026-53075.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-53075","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53075"},"summary":{"title":"ppp: require CAP_NET_ADMIN in target netns for unattached ioctls","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file->f_cred->user_ns,\nwhile unattached administrative ioctls operate on current->nsproxy->net_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-06-24 17:17:21","updated_at":"2026-06-28 08:16:32"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532","name":"https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067","name":"https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d","name":"https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c","name":"https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54","name":"https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e","name":"https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8","name":"https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e","name":"https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53075","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53075","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e c9edd90c57ae23692fff6b049fdfa4572a9fd532 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 5080e188c914110034bbc569d5cfa2f06204681d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 67e901e28d177ac9a9bed76d69ce3471e704a89e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 954745d0223e7caec917c0b2d1a889ff56fa6e54 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 3b2c2157dc2afc5c17cd7238afefca92f1ef330e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 1a8a51ce85075a56a743b6f142606dd2696a391c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 273ec51dd7ceaa76e038875d85061ec856d8905e 2bb6379416fd19f44c3423a00bfd8626259f6067 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.30","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.30 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.258 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.209 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.175 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.141 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.91 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.33 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.10 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"53075","cve":"CVE-2026-53075","epss":"0.002570000","percentile":"0.170270000","score_date":"2026-06-27","updated_at":"2026-06-28 00:08:51"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ppp/ppp_generic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9edd90c57ae23692fff6b049fdfa4572a9fd532","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"5080e188c914110034bbc569d5cfa2f06204681d","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"67e901e28d177ac9a9bed76d69ce3471e704a89e","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"954745d0223e7caec917c0b2d1a889ff56fa6e54","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"3b2c2157dc2afc5c17cd7238afefca92f1ef330e","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"5013be175c7ffd8b39efbc3c9c4db5b10b85fea8","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"1a8a51ce85075a56a743b6f142606dd2696a391c","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"},{"lessThan":"2bb6379416fd19f44c3423a00bfd8626259f6067","status":"affected","version":"273ec51dd7ceaa76e038875d85061ec856d8905e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ppp/ppp_generic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.91","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.33","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.258","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.209","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.175","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.141","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.91","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.33","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.10","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"2.6.30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file->f_cred->user_ns,\nwhile unattached administrative ioctls operate on current->nsproxy->net_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-06-28T06:38:59.844Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"},{"url":"https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"},{"url":"https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"},{"url":"https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"},{"url":"https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"},{"url":"https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"},{"url":"https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"},{"url":"https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"}],"title":"ppp: require CAP_NET_ADMIN in target netns for unattached ioctls","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-53075","datePublished":"2026-06-24T16:30:16.214Z","dateReserved":"2026-06-09T07:44:35.383Z","dateUpdated":"2026-06-28T06:38:59.844Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-24 17:17:21","lastModifiedDate":"2026-06-28 08:16:32","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2,"impactScore":6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"53075","Ordinal":"1","Title":"ppp: require CAP_NET_ADMIN in target netns for unattached ioctls","CVE":"CVE-2026-53075","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"53075","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file->f_cred->user_ns,\nwhile unattached administrative ioctls operate on current->nsproxy->net_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase.","Type":"Description","Title":"ppp: require CAP_NET_ADMIN in target netns for unattached ioctls"}]}}}