CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
In the Linux kernel, the following vulnerability has been resolved:
ppp: require CAPNETADMIN in target netns for unattached ioctls
/dev/ppp open is currently authorized against file->fcred->userns, while unattached administrative ioctls operate on current->nsproxy->netns.
As a result, a local unprivileged user can create a new user namespace with CLONENEWUSER, gain CAPNETADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace.
Require CAPNETADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls.
This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - Configuration
Update the Linux kernel so that PPP administrative ioctls (e.g., PPPIOCNEWUNIT, PPPIOCATTACH, PPPIOCATTCHAN) require CAP_NET_ADMIN in the user namespace that owns the target network namespace, rejecting userns-only inherited netns. Ensure unattached PPP administrative ioctls operate on current->nsproxy->net_ns only after this check.
Linux kernel Require CAP_NET_ADMIN in user namespace that owns the target network (for unattached PPP administrative ioctls) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53075?
CVE-2026-53075 has a critical severity score of 9.8.
What systems are affected by CVE-2026-53075?
CVE-2026-53075 affects the Linux kernel and the Microsoft azl3 kernel version 6.6.139.1-1.
How do I fix CVE-2026-53075?
To fix CVE-2026-53075, ensure you update to the latest version of the Linux kernel that addresses this vulnerability.
What type of vulnerability is CVE-2026-53075 classified as?
CVE-2026-53075 is classified as a local privilege escalation vulnerability.
What implications does CVE-2026-53075 have on system security?
CVE-2026-53075 allows local users to perform unauthorized administrative actions in network namespaces, compromising system security.