Skip to main content

Linux Kernel EUVDEUVD-2026-55525

| CVE-2026-68142 HIGH
2026-08-10 Linux GHSA-2rrg-cg9g-pgvw
Information Disclosure Linux Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local attack via netlink requiring CAP_NET_ADMIN (PR:L); Scope:Changed because impact crosses into a separate privileged underlay netns the attacker does not control.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:46 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

geneve: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in geneve->net can rewrite a geneve device whose underlay lives in geneve->net.

geneve_changelink() applies the new configuration against geneve->net: geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair reopen the underlay sockets in that netns (geneve_sock_add() uses geneve->net), so the same reasoning as the tunnel changelink series applies here.

Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series.

Found by 0sec automated security-research tooling (https://0sec.ai).

AnalysisAI

Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

GENEVE (Generic Network Virtualization Encapsulation) is a Linux kernel tunnel driver used extensively in cloud and container overlay networking stacks such as Kubernetes CNI plugins and OpenStack Neutron. The vulnerability resides in geneve_changelink() within the kernel's RTNL (Route Netlink) changelink path. Linux network namespaces permit isolated network stacks; a GENEVE device may exist in one namespace (dev_net(dev)) while its underlay socket is bound in another (geneve->net), which diverge when a device is created inside or moved to a different netns. The RTNL changelink path checks CAP_NET_ADMIN only against dev_net(dev), but geneve_link_config(), geneve_quiesce(), and geneve_unquiesce() all operate against geneve->net, reopening underlay sockets via geneve_sock_add() in that separate namespace. This missing second authorization check is the root cause - analogous to CWE-862 (Missing Authorization), though NVD lists CWE as N/A. The fix gates geneve_changelink() with rtnl_dev_link_net_capable() at the top of the function, before any attribute parsing, matching the pattern applied to ipgre_changelink() and the broader kernel tunnel changelink hardening series. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected product. The flaw was discovered by 0sec automated security-research tooling.

RemediationAI

Upgrade to a patched kernel version corresponding to the deployed stable branch: 7.1.6 or 7.2-rc5 for mainline, 6.18.42 for the 6.18 stable tree, 6.12.101 for the 6.12 stable tree, or 6.6.148 for the 6.6 long-term stable tree. Patch commits are available at the git.kernel.org stable references listed in the affected products section. If immediate kernel upgrade is not feasible, the primary compensating control is to deny CAP_NET_ADMIN to untrusted container workloads - via Kubernetes PodSecurityAdmission (restricted or baseline profiles), seccomp profiles, or AppArmor/SELinux policies - preventing the privilege differential between namespaces that enables this attack; the trade-off is that legitimate overlay-networking workloads requiring CAP_NET_ADMIN may need alternative configurations. Disabling GENEVE device creation entirely in untrusted namespaces (via network policy enforcement at the host level) also removes the attack surface but will break CNI plugins relying on GENEVE-based overlays. Linux distribution vendors (RHEL, Ubuntu, SUSE, Debian) are expected to backport these fixes; consult each vendor's security advisory tracker for patched package availability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55525 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy