CVE-2026-53075ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 273ec51dd7ceaa76e038875d85061ec856d8905e before c9edd90c57ae23692fff6b049fdfa4572a9fd532; from 273ec51dd7ceaa76e038875d85061ec856d8905e before 5080e188c914110034bbc569d5cfa2f06204681d; 273ec51dd7ceaa76e038875d85061ec856d8905e builds before 67e901e28d177ac9a9bed76d69ce3471e704a89e; from 273ec51dd7ceaa76e038875d85061ec856d8905e before 954745d0223e7caec917c0b2d1a889ff56fa6e54; 273ec51dd7ceaa76e038875d85061ec856d8905e builds before 3b2c2157dc2afc5c17cd7238afefca92f1ef330e; from 273ec51dd7ceaa76e038875d85061ec856d8905e before 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8; 273ec51dd7ceaa76e038875d85061ec856d8905e builds before 1a8a51ce85075a56a743b6f142606dd2696a391c; 273ec51dd7ceaa76e038875d85061ec856d8905e builds before 2bb6379416fd19f44c3423a00bfd8626259f6067 | CNA record |
linux linux_kernel linux:linux_kernel | from 2.6.30 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10 | NVD |
References
- https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532patch
- https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681dpatch
- https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89epatch
- https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54patch
- https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330epatch
- https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8patch
- https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391cpatch
- https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.