Look up another CVE · open CVE-2026-63829 in the interactive tracker
CVE-2026-63829
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem include/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63829 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.95-1 | Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper. Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/net/rtnetlink.h
net/core/rtnetlink.c
net/ipv4/ip_gre.c
- What this is
- NETWORKING [GENERAL]MAINTAINERS section matched on include/net/ · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.16 | 5.10.261 | 19275943d8fe |
| 3.16 | 5.15.212 | 866b0f5ae599 |
| 3.16 | 6.1.178 | 92b766fc5515 |
| 3.16 | 6.6.145 | e54c05ed3d9c |
| 3.16 | 6.12.95 | 9831bc9ecb40 |
| 3.16 | 6.18.38 | 1697957eb097 |
| 3.16 | 7.1.3 | 47b5d3d50660 |
| 3.16 | 7.2 | 8165f7ff57d9 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.
- AC:LAttack complexity, low
- Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.
- PR:LPrivileges required, low
- The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.
- UI:NUser interaction, none
- Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.
- S:CScope, changed
- The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.
- C:HConfidentiality impact, high
- An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.
- I:HIntegrity impact, high
- Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.
- A:HAvailability impact, high
- Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services.