{"id":"CVE-2026-68432","revision":"96423b30094d48d6998a39495fc5d193","records":[{"revision":"96423b30094d48d6998a39495fc5d193","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68432","aliases":[],"title":"vxlan: require CAP_NET_ADMIN in the device netns for changelink","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan->net. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan->net can rewrite a vxlan\ndevice whose underlay lives in vxlan->net.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).","state":0,"publishedAt":"2026-08-12T00:07:18.806+00:00","modifiedAt":"2026-10-19T21:09:10.15+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/vxlan/vxlan_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"b95a8743e58f7efed5ddc4cb73829b66f17feab0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"7465ade989ba84adc2bfa58bad3ca25d249f0f7a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"0aa580a8bbbed2507b4582a1f0ef581d480d06ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"b3793d7dccb192ffff29894d11824db6251acdd5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"730c7e5fea7f06e0cdf21c547222ec93234fd1d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"e8ad0d311e225939a9a6c745d6cc384c7364ec87\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8bcdc4f3a20be949df54b67e5ae2734daabb5792\",\n                            \"lessThan\": \"3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/vxlan/vxlan_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0","https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a","https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed","https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5","https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f","https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6","https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87","https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68432","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68432","identifiers":["CVE-2026-68432"]},"retained":false,"historicalAffected":[]}],"coverage":[]}