Unrated

Linux kernel ip_gre changelink cross-namespace CAP_NET_ADMIN authorization bypass

IdentifiersCVE-2026-63829CWE-863

CVE-2026-63829 is an authorization flaw in the Linux kernel networking stack affecting GRE and ERSPAN tunnel reconfiguration through the rtnetlink RTM_NEWLINK changelink path. A tunnel changelink operation can involve two network namespaces: the namespace of the device being modified and the tunnel link namespace associated with the tunnel object. In affected code paths, the rtnetlink changelink handling validated CAP_NET_ADMIN only in the device network namespace. When the tunnel resided in a different network namespace, a caller with CAP_NET_ADMIN in the device namespace but without equivalent privilege in the tunnel link namespace could still modify the tunnel configuration. The issue affects ipgre_changelink() and erspan_changelink(). The fix introduces an additional capability check for the link network namespace via rtnl_dev_link_net_capable() and places that check before attribute parsing, because the parsing logic can update live tunnel fields before the main changelink routine completes.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker or local user with CAP_NET_ADMIN in one network namespace to bypass intended namespace privilege boundaries and reconfigure GRE or ERSPAN tunnels that belong to another network namespace where they do not hold CAP_NET_ADMIN. This can result in unauthorized modification of tunnel parameters, weakening of network isolation assumptions, and potential disruption or redirection of encapsulated traffic.

Mitigation

If you can’t patch tonight, do this now.

Restrict delegation of CAP_NET_ADMIN, especially in containerized or multi-tenant environments that use multiple network namespaces and GRE or ERSPAN tunnels. Avoid allowing principals that are privileged only in one namespace to manage tunnel devices associated with another namespace. Where immediate patching is not possible, limit access to rtnetlink-based tunnel reconfiguration and minimize use of cross-namespace tunnel management patterns.

Remediation

Patch, then assume compromise.

Upgrade to a Linux kernel release containing the fix for CVE-2026-63829. The remediation adds rtnl_dev_link_net_capable() checks to the affected changelink handlers so that CAP_NET_ADMIN is required in the tunnel link network namespace before any changelink attributes are processed. Systems maintaining custom kernels should backport the patch that gates ipgre_changelink() and erspan_changelink() on the link-namespace capability check.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

7 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-63829

NVD

nvd.nist.gov/vuln/detail/CVE-2026-63829

MITRE CWE · CWE-863

cwe.mitre.org

git.kernel.org

git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105

git.kernel.org

git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572

git.kernel.org

git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7

git.kernel.org

git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296

Linux kernel ip_gre changelink cross-namespace CAP_NET_ADMIN authorization bypass

IdentifiersCVE-2026-63829CWE-863