CVE-2026-53075

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

State: Published
Severity: 8.8 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

/dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns.

As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace.

Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls.

This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
LinuxLinux	273ec51dd7ceaa76e038875d85061ec856d8905e to before c9edd90c57ae23692fff6b049fdfa4572a9fd532Affected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 5080e188c914110034bbc569d5cfa2f06204681dAffected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 67e901e28d177ac9a9bed76d69ce3471e704a89eAffected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 954745d0223e7caec917c0b2d1a889ff56fa6e54Affected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 3b2c2157dc2afc5c17cd7238afefca92f1ef330eAffected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8Affected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 1a8a51ce85075a56a743b6f142606dd2696a391cAffected 273ec51dd7ceaa76e038875d85061ec856d8905e to before 2bb6379416fd19f44c3423a00bfd8626259f6067Affected
LinuxLinux	2.6.30Affected before 2.6.30Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

273ec51dd7ceaa76e038875d85061ec856d8905e to before c9edd90c57ae23692fff6b049fdfa4572a9fd532Affected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 5080e188c914110034bbc569d5cfa2f06204681dAffected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 67e901e28d177ac9a9bed76d69ce3471e704a89eAffected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 954745d0223e7caec917c0b2d1a889ff56fa6e54Affected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 3b2c2157dc2afc5c17cd7238afefca92f1ef330eAffected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8Affected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 1a8a51ce85075a56a743b6f142606dd2696a391cAffected
273ec51dd7ceaa76e038875d85061ec856d8905e to before 2bb6379416fd19f44c3423a00bfd8626259f6067Affected

LinuxLinux

2.6.30Affected
before 2.6.30Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.