CVE-2026-53075

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Point-to-Point Protocol (PPP) implementation where /dev/ppp open is authorized against file->f cred->user ns, while unattached administrative ioctls operate on current->nsproxy->net ns. This allows a local unprivileged user to create a new user namespace using CLONE NEWUSER and obtain CAP NET ADMIN privileges within that specific namespace. Consequently, the user can issue administrative ioctls such as PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. This occurs because the system fails to verify CAP NET ADMIN in the user namespace that owns the target network namespace before processing these requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.