{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63829", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.014Z", "datePublished": "2026-07-19T12:02:23.191Z", "dateUpdated": "2026-08-05T12:36:12.246Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:12.246Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t->net. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t->net can rewrite a tunnel that\nlives in t->net.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t->collect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/rtnetlink.h", "net/core/rtnetlink.c", "net/ipv4/ip_gre.c"], "versions": [{"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "19275943d8fe903eb7b9aa53e380e41efd042ada", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "866b0f5ae599490bd496fd84581c68ac8b94e6af", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "92b766fc55156e0da2ecd0c2302c971118f8a229", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "e54c05ed3d9c28733fb9e5837219aca3691defa3", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "9831bc9ecb402957810c2045c663fbfe9b09e296", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "1697957eb0971d420dde42862b88eb43506a1105", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "47b5d3d506609b08b2e1f7c14f0b681a1953d572", "status": "affected", "versionType": "git"}, {"version": "b57708add31494175be741ed3fd24023b50c3423", "lessThan": "8165f7ff57d9667d2bb477ef6af83ede7fed4ad7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/rtnetlink.h", "net/core/rtnetlink.c", "net/ipv4/ip_gre.c"], "versions": [{"version": "3.16", "status": "affected"}, {"version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada"}, {"url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af"}, {"url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229"}, {"url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3"}, {"url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296"}, {"url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105"}, {"url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572"}, {"url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7"}], "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "id": "2502230", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502230"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t->net. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t->net can rewrite a tunnel that\nlives in t->net.\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t->collect_md before\nip_tunnel_changelink() runs.\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK.", "A flaw was found in the Linux kernel's IP Generic Routing Encapsulation (ip_gre) component. This vulnerability allows a local attacker with network administration capabilities in one network namespace to modify a tunnel residing in a different network namespace where they lack privileges. This is due to an insufficient capability check in the `changelink()` function, which only verifies permissions in the device's network namespace and not the tunnel's. Successful exploitation could lead to unauthorized alteration of network tunnel configurations, potentially causing network disruption or redirection of traffic."], "name": "CVE-2026-63829", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63829\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63829\nhttps://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63829-ff2a@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b57708add31494175be741ed3fd24023b50c3423,9831bc9ecb402957810c2045c663fbfe9b09e296)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b57708add31494175be741ed3fd24023b50c3423,1697957eb0971d420dde42862b88eb43506a1105)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b57708add31494175be741ed3fd24023b50c3423,47b5d3d506609b08b2e1f7c14f0b681a1953d572)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b57708add31494175be741ed3fd24023b50c3423,8165f7ff57d9667d2bb477ef6af83ede7fed4ad7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T10:00:04.565000+00:00", "updated": "2026-07-30T22:15:13.598179+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}