Skip to main content

Linux Kernel CVE-2026-63829

| EUVDEUVD-2026-45495 HIGH
2026-07-19 Linux GHSA-6wc5-2mjj-pmr6
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.7 HIGH

Local, low-complexity abuse requiring existing CAP_NET_ADMIN (PR:L); scope changes to another netns (S:C); primary impact is unauthorized reconfiguration (I:H) and disruption (A:H), with only secondary disclosure (C:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:N
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:46 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 8.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.

Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.

Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

AnalysisAI

Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.

Technical ContextAI

GRE (Generic Routing Encapsulation) tunnels and their ERSPAN mirroring variant are managed in the kernel via rtnetlink RTM_NEWLINK 'changelink' operations. A tunnel netdevice can be created in or moved to a network namespace (t->net) different from the namespace in which the reconfiguration request runs (dev_net(dev)). The flaw is an improper privilege-management / missing-authorization class issue (CWE-862/CWE-269, though CWE is listed as N/A in the source data): ipgre_changelink() and erspan_changelink() parse and apply attributes to live tunnel fields (for example ipgre_netlink_parms() setting t->collect_md before ip_tunnel_changelink() runs) without first confirming the caller holds CAP_NET_ADMIN in the tunnel's link netns. The fix introduces a rtnl_dev_link_net_capable() helper in net/core/rtnetlink.c that enforces CAP_NET_ADMIN in the link netns (and is skipped when link netns equals dev_net(dev), already checked), gating both changelink ops before any attribute parsing - mirroring the earlier ioctl-path fix in commit 8b484efd5cb4 for vti6. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1 (or your distribution's backported equivalent), which add the CAP_NET_ADMIN check in the tunnel's link netns for ipgre_changelink() and erspan_changelink(). The upstream fixes are available as stable commits at https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296, https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105, https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572, and https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7. Where immediate patching is not possible, reduce exposure by not granting CAP_NET_ADMIN to untrusted or lower-trust namespaces/containers (drop the capability from container runtimes that do not need network administration), and avoid configurations where GRE/ERSPAN tunnels are created in or moved across namespaces that untrusted principals can also administer; the trade-off is that dropping CAP_NET_ADMIN breaks legitimate in-container network configuration, so scope it to workloads that genuinely require tunnel management.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63829 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy