CVE-2026-53075
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | c9edd90c57ae23692fff6b049fdfa4572a9fd532 | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 5080e188c914110034bbc569d5cfa2f06204681d | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 67e901e28d177ac9a9bed76d69ce3471e704a89e | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 954745d0223e7caec917c0b2d1a889ff56fa6e54 | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 3b2c2157dc2afc5c17cd7238afefca92f1ef330e | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8 | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 1a8a51ce85075a56a743b6f142606dd2696a391c | Unavailable | None listed |
| 273ec51dd7ceaa76e038875d85061ec856d8905e | affected | git | 2bb6379416fd19f44c3423a00bfd8626259f6067 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.30 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.30 | Unavailable | None listed |
| 5.10.258 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.209 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.175 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.141 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.91 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.33 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.0.10 | unaffected | semver | Unavailable | 7.0.* | None listed |
| 7.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |