CVE-2026-63829
Received Received - Intake

Privilege Escalation in Linux Kernel via GRE Tunnel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper. Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63829
EUVD
EUVD-2026-45495

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing capability check in the GRE tunnel changelink operation. A user with CAP_NET_ADMIN privileges in one network namespace could modify a tunnel device located in a different network namespace without proper authorization. The fix adds a check to require CAP_NET_ADMIN in the tunnel's network namespace before allowing changes.

Detection Guidance

This vulnerability involves improper privilege checks in the Linux kernel's GRE tunnel changelink operation. Detection requires checking for unauthorized modifications to GRE tunnels. Examine kernel logs for suspicious netlink operations or tunnel reconfigurations. Use commands like 'ip -d link show' to inspect tunnel configurations and 'dmesg | grep -i gre' to look for related errors or warnings.

Impact Analysis

If exploited, this vulnerability could allow an attacker with limited privileges to alter network tunnel configurations, potentially leading to unauthorized network access, data interception, or disruption of network services. Systems using GRE tunnels are most at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a privilege escalation issue in the Linux kernel's network subsystem, specifically related to CAP_NET_ADMIN capabilities in netns. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access to sensitive data or systems, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor network configurations for unauthorized changes. If GRE tunnels are not required, disable them using 'modprobe -r ip_gre' and block related ports in firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart