CVE-2026-53075: Linux Kernel PPP Privilege Escalation

CVE-2026-53075 Overview

CVE-2026-53075 is a Linux kernel vulnerability in the Point-to-Point Protocol (PPP) subsystem. The flaw allows a local unprivileged user to bypass network namespace capability checks when issuing unattached administrative ioctls on /dev/ppp.

The /dev/ppp device authorizes opens against file->f_cred->user_ns, while unattached administrative ioctls operate against current->nsproxy->net_ns. This mismatch allows a user to create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new namespace, and still issue privileged PPP ioctls against an inherited network namespace.

Critical Impact
A local unprivileged user can perform PPP administrative operations (PPPIOCNEWUNIT, PPPIOCATTACH, PPPIOCATTCHAN) in a network namespace they do not actually hold privileges in.

Affected Products

Linux kernel PPP subsystem (drivers/net/ppp/ppp_generic.c)
Multiple stable kernel branches receiving backports across eight upstream commits
Linux distributions shipping vulnerable kernel releases prior to the fix

Discovery Timeline

2026-06-24 - CVE-2026-53075 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53075

Vulnerability Analysis

The vulnerability stems from inconsistent capability checking between two kernel namespace contexts. When a process opens /dev/ppp, the kernel evaluates credentials against the user namespace referenced by the opening file's credentials. However, when the same process later issues administrative ioctls before attaching to a specific PPP unit or channel, the kernel operates on the network namespace pointed to by the calling task's nsproxy.

This split creates an authorization gap. A user can hold CAP_NET_ADMIN in a freshly created user namespace while still operating within an inherited, parent network namespace where the same capability would normally be denied. The kernel honors the capability bit from the new user namespace without verifying that the namespace actually owns the target network namespace.

The issue is categorized as an Improper Access Control flaw affecting kernel namespace isolation guarantees.

Root Cause

The root cause is a missing capability check tying the CAP_NET_ADMIN requirement to the user namespace that owns the target network namespace. Administrative ioctls such as PPPIOCNEWUNIT, PPPIOCATTACH, and PPPIOCATTCHAN need network-namespace-scoped privileges, but the original code accepted any holder of CAP_NET_ADMIN in any user namespace.

Attack Vector

A local unprivileged user creates a new user namespace using unshare with CLONE_NEWUSER. Inside that namespace, the user automatically receives CAP_NET_ADMIN. Without unsharing the network namespace, the process inherits the parent's net_ns. The user then opens /dev/ppp and invokes one of the unattached administrative ioctls. The kernel observes CAP_NET_ADMIN in the current user namespace and permits the operation against the inherited, more privileged network namespace.

The fix requires CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves legitimate pppd operation in network namespaces where the daemon is genuinely privileged. See the upstream patch series, including Kernel Git Commit 1a8a51c and Kernel Git Commit 954745d, for technical details.

Detection Methods for CVE-2026-53075

Indicators of Compromise

Unprivileged processes invoking unshare(CLONE_NEWUSER) followed immediately by opens of /dev/ppp
ioctl calls with codes PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN originating from processes whose UID maps to nobody in the host namespace
Unexpected creation of PPP interfaces (ppp0, ppp1, etc.) in network namespaces without an active pppd service

Detection Strategies

Audit openat syscalls targeting /dev/ppp using auditd or eBPF tracing, correlated with the calling process's user namespace identifier
Monitor ioctl syscalls on PPP file descriptors and alert when the calling task's nsproxy->net_ns differs from its f_cred->user_ns ownership
Hunt for processes that combine CLONE_NEWUSER namespace creation with PPP device access in short time windows

Monitoring Recommendations

Enable kernel audit rules for /dev/ppp access and PPP-related ioctls across production hosts
Track creation of network interfaces by uid 0 inside non-root user namespaces using netlink monitoring
Forward kernel and audit logs to a centralized analytics platform for namespace-aware correlation

How to Mitigate CVE-2026-53075

Immediate Actions Required

Apply the upstream kernel patches referenced by the commits at git.kernel.org once available in your distribution's stable channel
Inventory hosts that load the ppp_generic module and prioritize patching multi-tenant or container-host systems
Restrict creation of unprivileged user namespaces on systems that do not require them by setting kernel.unprivileged_userns_clone=0 where supported

Patch Information

The fix adds an explicit CAP_NET_ADMIN check against the user namespace that owns the target network namespace before processing unattached PPP administrative ioctls. The upstream resolution is distributed across eight stable-branch commits, including 1a8a51c, 2bb6379, 3b2c215, 5013be1, 5080e18, 67e901e, 954745d, and c9edd90. Consult your Linux distribution's security advisories for backported kernel package versions.

Workarounds

Blacklist the ppp_generic kernel module on systems that do not require PPP connectivity using /etc/modprobe.d/
Disable unprivileged user namespace creation via sysctl kernel.unprivileged_userns_clone=0 on Debian-derived systems or by setting user.max_user_namespaces=0 for specific user sessions
Apply mandatory access control policies (SELinux, AppArmor) to deny non-root access to /dev/ppp

bash

# Configuration example: disable unprivileged user namespaces and PPP module
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-53075.conf
echo 'install ppp_generic /bin/true' > /etc/modprobe.d/disable-ppp.conf