CVE-2026-63829 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.
Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's networking subsystem, specifically affecting GRE (Generic Routing Encapsulation) tunnel implementations. The issue stems from an inadequate privilege checking mechanism during network device configuration operations, creating a potential security escalation vector. When a tunnel device undergoes a changelink operation, the system must verify appropriate permissions across multiple network namespaces, but the current implementation only validates capabilities against the device's original namespace rather than the target namespace where the tunnel actually resides.
The technical flaw manifests in how the kernel handles network namespace transitions during tunnel configuration changes. The rtnl (route netlink) changelink path performs capability checks using CAP_NET_ADMIN against the device's current network namespace dev_net(dev), but fails to validate the same capability requirement against the tunnel's actual network namespace t->net. This discrepancy allows a malicious user with appropriate privileges in one namespace to modify tunnel configurations that exist in a different namespace where they might not possess sufficient permissions.
Network administrators and security professionals should recognize this as a privilege escalation vulnerability that could be exploited through carefully crafted network configuration changes. The impact extends beyond simple access control violations, potentially allowing attackers to modify routing behavior, manipulate network traffic flows, or establish persistent network access points. This vulnerability directly maps to CWE-276, which describes improper privileges for critical resources within the Linux kernel networking stack.
The operational security implications are significant as this flaw enables lateral movement between network namespaces without proper authorization checks. Attackers could leverage this weakness to modify existing tunnel configurations, potentially redirecting traffic or creating backdoor network paths. The vulnerability affects both ipgre_changelink() and erspan_changelink() operations, making it particularly concerning for environments that rely extensively on GRE tunnels for network virtualization or secure communications.
Security mitigations should focus on implementing the new rtnl_dev_link_net_capable() helper function that was introduced to address this specific issue. This approach requires CAP_NET_ADMIN privileges in the link netns rather than just the device's current namespace, ensuring proper authorization checks regardless of where the tunnel resides within the network namespace hierarchy. The fix follows established patterns from similar security patches such as commit 8b484efd5cb4 that applied equivalent protections to ioctl paths. Organizations should prioritize applying kernel updates that include this patch, particularly in environments where network namespaces are heavily utilized or where GRE tunneling is prevalent for network virtualization purposes.
The implementation of this fix demonstrates adherence to the principle of least privilege and proper capability checking within the Linux kernel's networking subsystem. By requiring authorization checks against the actual network namespace where operations occur rather than the calling context, the system prevents unauthorized modifications to network resources. This approach aligns with ATT&CK technique T1068 by preventing unauthorized local privilege escalation through improper access control mechanisms in kernel space operations. The solution represents a defensive programming pattern that strengthens the kernel's security posture against potential exploitation attempts targeting network namespace transitions and tunnel configuration changes.