Linux Kernel CVE-2026-68142

GENEVE (Generic Network Virtualization Encapsulation) is a Linux kernel tunnel driver used extensively in cloud and container overlay networking stacks such as Kubernetes CNI plugins and OpenStack Neutron. The vulnerability resides in geneve_changelink() within the kernel's RTNL (Route Netlink) changelink path. Linux network namespaces permit isolated network stacks; a GENEVE device may exist in one namespace (dev_net(dev)) while its underlay socket is bound in another (geneve->net), which diverge when a device is created inside or moved to a different netns. The RTNL changelink path checks CAP_NET_ADMIN only against dev_net(dev), but geneve_link_config(), geneve_quiesce(), and geneve_unquiesce() all operate against geneve->net, reopening underlay sockets via geneve_sock_add() in that separate namespace. This missing second authorization check is the root cause - analogous to CWE-862 (Missing Authorization), though NVD lists CWE as N/A. The fix gates geneve_changelink() with rtnl_dev_link_net_capable() at the top of the function, before any attribute parsing, matching the pattern applied to ipgre_changelink() and the broader kernel tunnel changelink hardening series. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected product. The flaw was discovered by 0sec automated security-research tooling.