CVE-2026-68142

Status: UPDATED  |  Advisory ID: CVE-2026-68142

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

geneve: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and

the sticky underlay netns geneve->net. They differ once the device is

created in or moved to a netns other than the one the request runs in.

The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),

so a caller privileged there but not in geneve->net can rewrite a geneve

device whose underlay lives in geneve->net.

geneve_changelink() applies the new configuration against geneve->net:

geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair

reopen the underlay sockets in that netns (geneve_sock_add() uses

geneve->net), so the same reasoning as the tunnel changelink series

applies here.

Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of

the op before any attribute is parsed, matching ipgre_changelink() and

the rest of the "require CAP_NET_ADMIN in the device netns for

changelink" series.

Found by 0sec automated security-research tooling (https://0sec.ai). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References