cbcvebase.
CVE-2026-53075
published 2026-06-24

CVE-2026-53075: In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently…

PriorityP348high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.18%
8.0th percentile
In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.

Affected

19 ranges
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < c9edd90c57ae23692fff6b049fdfa4572a9fd532c9edd90c57ae23692fff6b049fdfa4572a9fd532
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 5080e188c914110034bbc569d5cfa2f06204681d5080e188c914110034bbc569d5cfa2f06204681d
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 67e901e28d177ac9a9bed76d69ce3471e704a89e67e901e28d177ac9a9bed76d69ce3471e704a89e
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 954745d0223e7caec917c0b2d1a889ff56fa6e54954745d0223e7caec917c0b2d1a889ff56fa6e54
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 3b2c2157dc2afc5c17cd7238afefca92f1ef330e3b2c2157dc2afc5c17cd7238afefca92f1ef330e
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 5013be175c7ffd8b39efbc3c9c4db5b10b85fea85013be175c7ffd8b39efbc3c9c4db5b10b85fea8
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 1a8a51ce85075a56a743b6f142606dd2696a391c1a8a51ce85075a56a743b6f142606dd2696a391c
linuxlinux>= 273ec51dd7ceaa76e038875d85061ec856d8905e < 2bb6379416fd19f44c3423a00bfd8626259f60672bb6379416fd19f44c3423a00bfd8626259f6067
linuxlinux_kernel
ubuntulinux
ubuntulinux-gcp
ubuntulinux-gcp-6.8
ubuntulinux-gke
ubuntulinux-gkeop
ubuntulinux-hwe-7.0
ubuntulinux-oem-7.0
ubuntulinux-realtime
ubuntulinux-realtime-6.8

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.