CVE-2026-68432

Received Received - Intake

Privilege Escalation in Linux Kernel VXLAN

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net. vxlan_changelink() validates and applies the new configuration against vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here. Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68432

EUVD

EUVD-2026-57040

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing permission check in the VXLAN tunnel changelink operation. A user with CAP_NET_ADMIN privileges in one network namespace (netns) but not in the underlay netns could modify a VXLAN device configuration, potentially allowing unauthorized network access or manipulation.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges in the device's network namespace for VXLAN changelink operations. Detection involves checking for unauthorized privilege escalation attempts in VXLAN device configurations. Inspect kernel logs for CAP_NET_ADMIN failures during VXLAN operations using: dmesg | grep -i vxlan or journalctl -k | grep -i vxlan. Review network namespace configurations with: ip netns list and check VXLAN device permissions with: ip link show type vxlan.

Impact Analysis

If exploited, this flaw could let an attacker with limited privileges alter network settings, disrupt communications, or gain access to isolated network segments. Systems using VXLAN tunnels may face unauthorized configuration changes or network instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel privilege escalation issue in VXLAN device configuration that could allow unauthorized users with CAP_NET_ADMIN privileges in one network namespace to modify VXLAN devices in another namespace. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access to sensitive data or systems, which is not explicitly described in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the vxlan changelink CAP_NET_ADMIN vulnerability. Restrict CAP_NET_ADMIN privileges to trusted users and processes.

Hi! I’m here to help you understand CVE-2026-68432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70