CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
geneve: require CAPNETADMIN in the device netns for changelink
A tunnel changelink() operates on at most two netns, devnet(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in geneve->net can rewrite a geneve device whose underlay lives in geneve->net.
genevechangelink() applies the new configuration against geneve->net: genevelinkconfig() and the genevequiesce()/geneveunquiesce() pair reopen the underlay sockets in that netns (genevesockadd() uses geneve->net), so the same reasoning as the tunnel changelink series applies here.
Gate genevechangelink() with rtnldevlinknetcapable(), at the top of the op before any attribute is parsed, matching ipgrechangelink() and the rest of the "require CAPNETADMIN in the device netns for changelink" series.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68142?
The severity of CVE-2026-68142 is rated as a risk of 34.
How do I fix CVE-2026-68142?
To fix CVE-2026-68142, ensure that the CAP_NET_ADMIN capability is required in the device netns for changelink operations.
What systems are affected by CVE-2026-68142?
CVE-2026-68142 impacts systems running the affected versions of the Linux kernel that utilize Geneve networking.
Is CVE-2026-68142 being actively exploited?
As of the publication date, there is no public information indicating active exploitation of CVE-2026-68142.
What should I do if I cannot apply the fix for CVE-2026-68142 immediately?
If you cannot apply the fix for CVE-2026-68142 immediately, consider implementing access controls to limit the use of the affected functionalities.