Executive brief
A vulnerability in the Linux kernel's Point-to-Point Protocol (PPP) driver could allow a local user to perform unauthorized network administrative actions. By exploiting a flaw in how the system checks permissions across different user environments (namespaces), an unprivileged user could create or modify network interfaces they should not have access to. This could lead to unauthorized network configuration changes or disruption of network services on the affected system.
Technical details
A vulnerability exists in the Linux kernel's ppp_generic driver where unattached administrative ioctls (PPPIOCNEWUNIT, PPPIOCATTACH, PPPIOCATTCHAN) are incorrectly authorized. While opening /dev/ppp is checked against the file opener's user namespace, the subsequent ioctls operate on the current network namespace. A local attacker can use CLONE_NEWUSER to create a new user namespace where they have CAP_NET_ADMIN, then use that privilege to issue ioctls against an inherited network namespace from the parent environment. The fix implements a check requiring CAP_NET_ADMIN within the user namespace that owns the target network namespace.
Affected products
- Linux Linux 2.6.30 to 6.14
Timeline
- 2026-04-09: disclosed: Initial patch submitted by Taegu Ha
- 2026-06-24: advisory: CVE-2026-53075 published
References
- https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c
- https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067
- https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e
- https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8
- https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d
- https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e
- https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54