Executive brief
A security flaw was identified in the Linux kernel's networking component that could allow a user with limited administrative privileges in one network area to modify network tunnels in another area where they should not have access. This could lead to unauthorized changes in how data is routed or encapsulated, potentially disrupting network services or redirecting traffic. The issue affects systems using GRE or ERSPAN tunnels across different network namespaces.
Technical details
A vulnerability in the Linux kernel's netlink interface (rtnetlink) allowed users with CAP_NET_ADMIN in a device's current network namespace to modify tunnel settings even if they lacked privileges in the tunnel's link network namespace. The root cause was that the rtnl changelink path only validated CAP_NET_ADMIN against dev_net(dev) and not the tunnel link netns (t->net). An attacker could exploit this to rewrite tunnel configurations by moving a device to a namespace where they have privileges. The fix introduces rtnl_dev_link_net_capable() to ensure CAP_NET_ADMIN is verified in the link namespace before ipgre_changelink() or erspan_changelink() parse attributes.
Affected products
- Linux Linux Kernel 3.16 to 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-06-12: disclosed: Initial patch submitted by Maoyi Xie
- 2026-07-04: patched: Patch committed to stable branches by Greg Kroah-Hartman
- 2026-07-19: advisory: CVE-2026-63829 published