|
ELS
< Back

CVE-2026-68142

Updated on 10 Aug 2026

Severity

8.8 High severity

Details

CVSS score
8.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

geneve: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in geneve->net can rewrite a geneve device whose underlay lives in geneve->net.

geneve_changelink() applies the new configuration against geneve->net: geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair reopen the underlay sockets in that netns (geneve_sock_add() uses geneve->net), so the same reasoning as the tunnel changelink series applies here.

Gate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the “require CAP_NET_ADMIN in the device netns for changelink” series.

Found by 0sec automated security-research tooling (https://0sec.ai).

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Debian 11 ELS , TuxCare 9.6 ESU , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
kernel @ 5.14.0 (+9 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9.2 ESU Released
33 kernels
  • 5.14.0-284.1101.el9_2.tuxcare.7.els20
  • 5.14.0-284.1101.el9_2.tuxcare.7.els21
  • 5.14.0-284.1101.el9_2.tuxcare.7.els23
  • 5.14.0-284.1101.el9_2.tuxcare.7.els22
  • 5.14.0-284.1101.el9_2.tuxcare.7.els14
  • 5.14.0-284.1101.el9_2.tuxcare.7.els18
  • 5.14.0-284.1101.el9_2.tuxcare.7.els16
  • 5.14.0-284.1101.el9_2.tuxcare.7.els15
  • 5.14.0-284.1101.el9_2.tuxcare.7.els17
  • 5.14.0-284.1101.el9_2.tuxcare.7.els19
  • 5.14.0-284.1101.el9_2.tuxcare.7.els24
  • 5.14.0-284.1101.el9_2.tuxcare.7.els25
  • 5.14.0-284.1101.el9_2.tuxcare.7.els26
  • 5.14.0-284.1101.el9_2.tuxcare.7.els27
  • 5.14.0-284.1101.el9_2.tuxcare.7.els28
  • 5.14.0-284.1101.el9_2.tuxcare.7.els29
  • 5.14.0-284.1101.el9_2.tuxcare.7.els30
  • 5.14.0-284.1101.el9_2.tuxcare.7.els31
  • 5.14.0-284.1101.el9_2.tuxcare.7.els32
  • 5.14.0-284.1101.el9_2.tuxcare.7.els35
  • 5.14.0-284.1101.el9_2.tuxcare.7.els34
  • 5.14.0-284.1101.el9_2.tuxcare.11.els1
  • 5.14.0-284.1101.el9_2.tuxcare.11.els2
  • 5.14.0-284.1101.el9_2.tuxcare.11.els3
  • 5.14.0-284.1101.el9_2.tuxcare.11.els4
  • 5.14.0-284.1101.el9_2.tuxcare.11.els5
  • 5.14.0-284.1101.el9_2.tuxcare.11.els6
  • 5.14.0-284.1101.el9_2.tuxcare.11.els7
  • 5.14.0-284.1101.el9_2.tuxcare.11.els8
  • 5.14.0-284.1101.el9_2.tuxcare.11.els9
  • 5.14.0-284.1101.el9_2.tuxcare.11.els10
  • 5.14.0-284.1101.el9_2.tuxcare.11.els11
  • 5.14.0-284.1101.el9_2.tuxcare.11.els12
Debian 12 Planned —
Oracle Linux 9 UEK 7 Planned —