Описание
In the Linux kernel, the following vulnerability has been resolved:
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
ip6gre_changelink() and ip6erspan_changelink() operate on at most two
netns, dev_net(dev) and the tunnel link netns t->net. They differ once
the device is created in or moved to a netns other than the one the
request runs in. The rtnl changelink path checks CAP_NET_ADMIN only
against dev_net(dev), so a caller privileged there but not in t->net can
rewrite a tunnel that lives in t->net.
Gate both ops on rtnl_dev_link_net_capable() at their top, before any
attribute is parsed.
A flaw was found in the Linux kernel's ip6_gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities (CAP_NET_ADMIN) across different network namespaces. This allows a local attacker, who has CAP_NET_ADMIN in one network namespace but not in the tunnel's network namespace, to modify the tunnel's configuration. This could lead to unauthorized changes to network tunnel settings.
Меры по смягчению последствий
If IPv6 GRE or IP-ERSpan tunnels are not in use, their respective kernel modules (ip6_gre and ip6erspan) can be blacklisted to prevent exploitation. Create a file such as /etc/modprobe.d/disable-ip6gre.conf with the following content:
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This mitigation may impact network functionality if these tunnel types are actively used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:75746 | 05.10.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:75747 | 05.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:76739 | 08.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:76739 | 08.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.
In the Linux kernel, the following vulnerability has been resolved: n ...
EPSS
7.8 High
CVSS3