FKIE_CVE-2026-53075

Vulnerability from fkie_nvd - Published: 2026-06-24 17:17 - Updated: 2026-06-28 08:16
Severity
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ppp/ppp_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9edd90c57ae23692fff6b049fdfa4572a9fd532",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "5080e188c914110034bbc569d5cfa2f06204681d",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "67e901e28d177ac9a9bed76d69ce3471e704a89e",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "954745d0223e7caec917c0b2d1a889ff56fa6e54",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "3b2c2157dc2afc5c17cd7238afefca92f1ef330e",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "5013be175c7ffd8b39efbc3c9c4db5b10b85fea8",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "1a8a51ce85075a56a743b6f142606dd2696a391c",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "2bb6379416fd19f44c3423a00bfd8626259f6067",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ppp/ppp_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file-\u003ef_cred-\u003euser_ns,\nwhile unattached administrative ioctls operate on current-\u003ensproxy-\u003enet_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."
    }
  ],
  "id": "CVE-2026-53075",
  "lastModified": "2026-06-28T08:16:32.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-24T17:17:21.450",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.