CVE-2026-68142

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the geneve module where the changelink() operation does not properly verify permissions across different network namespaces (netns). Specifically, the rtnl changelink path only checks for CAP NET ADMIN privileges against dev net(dev), ignoring the sticky underlay network namespace geneve->net. This allows a user with privileges in the device network namespace, but lacking them in the underlay network namespace, to rewrite a geneve device. The geneve changelink() function, along with geneve link config(), geneve quiesce(), and geneve unquiesce(), applies configurations and reopens underlay sockets within geneve->net via geneve sock add().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.