CVE-2026-63829

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the changelink() operation for tunnels does not properly validate permissions across network namespaces (netns). Specifically, the rtnl changelink path only verifies the CAP NET ADMIN capability against the device network namespace dev net(dev) and fails to check it against the tunnel link network namespace t->net. This allows a user with privileges in the device namespace, but lacking them in the link namespace, to rewrite a tunnel residing in t->net. This flaw affects ipgre changelink() and erspan changelink() during RTM NEWLINK operations. The issue is particularly relevant for container hosts and WSL 2 environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.