CVE-2026-68142geneve: require CAP_NET_ADMIN in the device netns for changelink
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: geneve: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in geneve->net can rewrite a geneve device whose underlay lives in geneve->net. geneve_changelink() applies the new configuration against geneve->net: geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair reopen the underlay sockets in that netns (geneve_sock_add() uses geneve->net), so the same reasoning as the tunnel changelink series applies here. Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before a5522963c57f12df5f9db804ebfc472b58eef0ae; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before 278c6a31ee27c931c722202c8c06cc3253923254; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before 11a7d989d00160481a273eb4f7f05f64b5a6ffdf; 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a builds before 2abdacc927c92fa6a9cc8341e8c9b88dcb561553; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before 9de5518fc1fab583526a8f66b8e505c4864dc60a; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before f8c498585d2a08aa623748353c3e61467b7e9fd2; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before 95f45e20f1b2cec13823f0f68060ab4b2261b2c1; from 5b861f6baa3a22a48d7a4ad0ce38a223d36c978a before 8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01 | CNA record |
References
- https://git.kernel.org/stable/c/a5522963c57f12df5f9db804ebfc472b58eef0ae
- https://git.kernel.org/stable/c/278c6a31ee27c931c722202c8c06cc3253923254
- https://git.kernel.org/stable/c/11a7d989d00160481a273eb4f7f05f64b5a6ffdf
- https://git.kernel.org/stable/c/2abdacc927c92fa6a9cc8341e8c9b88dcb561553
- https://git.kernel.org/stable/c/9de5518fc1fab583526a8f66b8e505c4864dc60a
- https://git.kernel.org/stable/c/f8c498585d2a08aa623748353c3e61467b7e9fd2
- https://git.kernel.org/stable/c/95f45e20f1b2cec13823f0f68060ab4b2261b2c1
- https://git.kernel.org/stable/c/8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.