CVE-2026-68142
Received Received - Intake

Privilege Escalation in Linux Kernel Geneve Tunnel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: geneve: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in geneve->net can rewrite a geneve device whose underlay lives in geneve->net. geneve_changelink() applies the new configuration against geneve->net: geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair reopen the underlay sockets in that netns (geneve_sock_add() uses geneve->net), so the same reasoning as the tunnel changelink series applies here. Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68142
EUVD
EUVD-2026-55525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a privilege escalation issue in the GENEVE tunnel device. It allows a user with CAP_NET_ADMIN privileges in one network namespace (netns) to modify a GENEVE device whose underlay network resides in a different netns without proper authorization. The changelink operation fails to check CAP_NET_ADMIN in the device's netns, enabling unauthorized configuration changes.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges in the device network namespace for GENEVE tunnel changelink operations. Detection involves checking for unauthorized privilege escalation attempts in network namespace operations. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker with limited privileges to alter network configurations, potentially disrupting network traffic or enabling further attacks. Systems using GENEVE tunnels with untrusted users in different netns are at risk of unauthorized network modifications.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Restrict CAP_NET_ADMIN privileges to trusted users and processes. Monitor network namespace operations for suspicious activity. Ensure GENEVE tunnel configurations are reviewed for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart