Improper access control in Linux kernel - CVE-2026-63829
Published: July 20, 2026
Vulnerability identifier: #VU138820
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63829
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.
The vulnerability exists due to improper access control in ipgre_changelink() and erspan_changelink() when handling RTM_NEWLINK changelink requests for GRE tunnel devices. A local privileged user can send a crafted RTM_NEWLINK request to modify tunnel configuration across network namespaces.
The issue occurs when the device network namespace differs from the tunnel link network namespace, because the check was performed only against dev_net(dev).
Affected software
Linux kernel
How to mitigate CVE-2026-63829
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3