CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-19
Weakness: CWE-863

Description

In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.

Affected products

Linux kernel: from 2.6.30 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33 — fixed in 5.10.258, 5.15.209, 6.1.175, 6.12.91, 6.18.33, 6.6.141

How to fix

Upgrade to a fixed version: Linux kernel 5.10.258, 5.15.209, 6.1.175, 6.12.91. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53075 or the next vulnerability affects your stack