SB20260720439 - Improper access control in Linux kernel ipv4

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-63829)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipgre_changelink() and erspan_changelink() when handling RTM_NEWLINK changelink requests for GRE tunnel devices. A local privileged user can send a crafted RTM_NEWLINK request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, because the check was performed only against dev_net(dev).

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105
• https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572
• https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7
• https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296