CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
vxlan: require CAPNETADMIN in the device netns for changelink
A tunnel changelink() operates on at most two netns, devnet(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net.
vxlanchangelink() validates and applies the new configuration against vxlan->net (vxlanconfigvalidate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here.
Gate vxlanchangelink() with rtnldevlinknetcapable(), at the top of the op before any attribute is parsed, matching ipgrechangelink() and the rest of the "require CAPNETADMIN in the device netns for changelink" series.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68432?
CVE-2026-68432 has a risk score of 37.
How do I fix CVE-2026-68432?
To mitigate CVE-2026-68432, ensure that the CAP_NET_ADMIN capability is required in the device's network namespace for any changelink operations.
Which software is affected by CVE-2026-68432?
CVE-2026-68432 affects the Linux kernel.
What is the impact of CVE-2026-68432?
CVE-2026-68432 can allow unauthorized modification of network device settings, posing a risk to network security.
When was CVE-2026-68432 published?
CVE-2026-68432 was published on August 12, 2026.