CVE-2026-63829: Linux Kernel Privilege Escalation Flaw

CVE-2026-63829 Overview

CVE-2026-63829 is a Linux kernel vulnerability in the net/ipv4/ip_gre.c GRE tunnel driver. The changelink() handler for GRE and ERSPAN tunnels only verifies CAP_NET_ADMIN against dev_net(dev), the network namespace where the netlink request runs. When a tunnel device has been moved to a different link namespace (t->net), a caller with capabilities in dev_net(dev) but not in t->net can rewrite a tunnel that lives in another netns. This breaks the namespace privilege boundary and can be abused for local privilege escalation across namespaces on multi-tenant Linux hosts.

Critical Impact
A local user with CAP_NET_ADMIN in one network namespace can modify GRE and ERSPAN tunnel configurations in a separate namespace, bypassing the namespace security boundary.

Affected Products

Linux kernel — GRE tunnel driver (net/ipv4/ip_gre.c)
Linux kernel — ERSPAN tunnel handling (erspan_changelink())
Linux kernel — RTM_NEWLINK rtnetlink path (net/core/rtnetlink.c)

Discovery Timeline

2026-07-19 - CVE-2026-63829 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63829

Vulnerability Analysis

A GRE tunnel changelink() operation touches at most two network namespaces: dev_net(dev), where the netlink request executes, and t->net, where the tunnel link itself lives. These namespaces diverge once the tunnel device is created in or moved to a namespace other than the one issuing the request.

The existing rtnetlink changelink path only checks CAP_NET_ADMIN against dev_net(dev). A caller privileged in that namespace but unprivileged in t->net can still rewrite tunnel parameters that belong to t->net. The vulnerability is classified as a missing authorization check on a cross-namespace object.

The issue is amplified because ipgre_netlink_parms() writes to live tunnel fields before ip_tunnel_changelink() runs. For example, t->collect_md is updated during attribute parsing, so state can be altered even if a later check were to fail.

Root Cause

The root cause is an improper access control check [CWE-284] in the GRE tunnel netlink handlers. The kernel checked capabilities only in the requesting netns and did not require CAP_NET_ADMIN in the tunnel's link netns. The fix introduces a helper, rtnl_dev_link_net_capable(), alongside rtnl_get_net_ns_capable() in net/core/rtnetlink.c. The helper enforces CAP_NET_ADMIN in the link netns and is skipped only when the link netns equals dev_net(dev).

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN in a network namespace that owns the netlink socket but not in the tunnel's link namespace. The attacker sends an RTM_NEWLINK request targeting a GRE or ERSPAN tunnel that lives in another namespace. Because ipgre_changelink() and erspan_changelink() did not gate their parsers on the link-netns capability, tunnel attributes such as endpoints, keys, and collect_md mode could be rewritten. Commit 8b484efd5cb4 previously added the equivalent check on the ioctl path for IPv6 VTI; this CVE closes the same gap on the RTM_NEWLINK path for GRE.

See the upstream fix commit for the exact code change. No public proof-of-concept is available.

Detection Methods for CVE-2026-63829

Indicators of Compromise

Unexpected RTM_NEWLINK netlink messages targeting GRE or ERSPAN tunnel devices that reside in a different namespace than the calling process.
Modifications to tunnel endpoints, keys, or collect_md flags on gre*, gretap*, or erspan* interfaces without a corresponding administrative change record.
Processes holding CAP_NET_ADMIN in a container or user namespace issuing netlink operations against host-namespace tunnel interfaces.

Detection Strategies

Audit rtnetlink activity with auditd rules on sys_sendmsg filtered for AF_NETLINK and NETLINK_ROUTE, correlating the PID's namespace with the target interface's namespace.
Monitor kernel tracepoints such as rtnl_newlink and interface change events via bpftrace or perf to capture cross-namespace configuration writes.
Compare running tunnel configuration snapshots from ip -d link show type gre against a known-good baseline across namespaces.

Monitoring Recommendations

Log container runtime events that grant CAP_NET_ADMIN and correlate with subsequent tunnel modifications on the host.
Alert on any GRE or ERSPAN tunnel parameter change originating from an unprivileged workload namespace.
Track kernel version and patch status across the fleet to identify hosts still exposed to CVE-2026-63829.

How to Mitigate CVE-2026-63829

Immediate Actions Required

Apply the vendor kernel update that includes the rtnl_dev_link_net_capable() helper and the gating in ipgre_changelink() and erspan_changelink().
Inventory hosts running containers or multi-tenant workloads that grant CAP_NET_ADMIN inside guest namespaces and prioritize patching there first.
Restrict user namespace creation for untrusted users via kernel.unprivileged_userns_clone=0 where operationally feasible.

Patch Information

The upstream fix is distributed across multiple stable branches. Relevant commits include 1697957eb097, 19275943d8fe, 47b5d3d50660, 8165f7ff57d9, 866b0f5ae599, 92b766fc5515, 9831bc9ecb40, and e54c05ed3d9c. Consult your distribution's advisory for the specific backport that matches your kernel series.

Workarounds

Avoid granting CAP_NET_ADMIN inside containers or user namespaces that do not require tunnel management.
Do not move GRE or ERSPAN tunnel devices into namespaces where untrusted workloads hold CAP_NET_ADMIN.
Use seccomp or LSM policies (AppArmor, SELinux) to restrict RTM_NEWLINK operations from untrusted processes.

bash

# Restrict unprivileged user namespaces (reduces attack surface)
sysctl -w kernel.unprivileged_userns_clone=0

# Verify kernel version includes the fix
uname -r

# Enumerate GRE/ERSPAN tunnels and their netns to audit exposure
for ns in $(ip netns list | awk '{print $1}'); do
    echo "[netns: $ns]"
    ip netns exec "$ns" ip -d link show type gre 2>/dev/null
    ip netns exec "$ns" ip -d link show type erspan 2>/dev/null
done