CVE-2026-68142 Overview
CVE-2026-68142 is a Linux kernel vulnerability in the geneve tunnel driver. The geneve_changelink() operation fails to require CAP_NET_ADMIN in the device's underlay network namespace (geneve->net). A local attacker privileged only in dev_net(dev) can reconfigure a geneve device whose underlay lives in a different netns. The rtnl changelink path validates capabilities only against dev_net(dev), permitting cross-namespace configuration changes on tunnel sockets.
Critical Impact
A local user with CAP_NET_ADMIN in one network namespace can modify geneve tunnels whose underlay sockets reside in a different, more privileged namespace, breaking netns isolation boundaries.
Affected Products
- Linux kernel builds containing the geneve driver prior to the referenced stable patch commits
- Container and virtualization hosts relying on network namespace isolation for tenant separation
- Distributions shipping kernels that predate commits 2abdacc, 8efb8f8, 95f45e2, 9de5518, and f8c4985
Discovery Timeline
- 2026-08-10 - CVE-2026-68142 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68142
Vulnerability Analysis
A geneve tunnel changelink() operation touches at most two network namespaces: dev_net(dev) where the netlink request executes, and the sticky underlay netns stored in geneve->net. These namespaces diverge once the device is moved to a different netns after creation.
The rtnl changelink code path enforces CAP_NET_ADMIN only against dev_net(dev). A caller who is privileged in that namespace but unprivileged in geneve->net can still rewrite tunnel attributes. The new configuration is then applied against geneve->net because geneve_link_config() and the geneve_quiesce()/geneve_unquiesce() sequence reopen underlay sockets in that namespace via geneve_sock_add().
The outcome is a namespace confinement failure: an attacker manipulates sockets and network state in a namespace where they should hold no administrative authority.
Root Cause
The root cause is a missing capability check across two namespaces during a privileged tunnel reconfiguration. geneve_changelink() did not call rtnl_dev_link_net_capable() before parsing attributes. This mirrors the same class of gap addressed across the broader "require CAP_NET_ADMIN in the device netns for changelink" series covering ipgre and related tunnel drivers.
Attack Vector
Exploitation requires local access and CAP_NET_ADMIN inside a namespace that holds a geneve device whose underlay socket lives elsewhere. The attacker issues an rtnetlink RTM_NEWLINK changelink request against the geneve interface, altering parameters such as the remote endpoint, VNI, or port. The kernel applies the changes to sockets in the underlay namespace without validating that the caller holds privileges there.
No synthetic exploit is published. Refer to the upstream commits linked in the references for the exact code path and fix.
Detection Methods for CVE-2026-68142
Indicators of Compromise
- Unexpected RTM_NEWLINK netlink events targeting geneve interfaces from processes inside container or user namespaces
- Runtime modification of geneve tunnel endpoints, VNI, or destination ports on hosts that do not perform such changes as part of normal operations
- Audit records showing CAP_NET_ADMIN-gated operations succeeding for processes whose effective namespace differs from the tunnel's underlay netns
Detection Strategies
- Monitor rtnetlink activity with the audit subsystem, filtering on msgtype=RTM_NEWLINK and interface kind geneve
- Correlate setns() and unshare() calls with subsequent netlink writes from the same process lineage
- Alert when geneve device attributes change on production hosts outside approved change windows
Monitoring Recommendations
- Enable kernel auditing for network configuration syscalls in multi-tenant and container hosts
- Ship netlink audit events into a centralized data lake for cross-host correlation
- Track kernel version inventory to identify unpatched hosts exposed to the flaw
How to Mitigate CVE-2026-68142
Immediate Actions Required
- Apply the upstream stable kernel updates that add rtnl_dev_link_net_capable() to geneve_changelink()
- Inventory hosts running kernels that predate the fix and prioritize patching multi-tenant and container platforms
- Restrict CAP_NET_ADMIN grants inside user and container namespaces to workloads that require it
Patch Information
The fix gates geneve_changelink() with rtnl_dev_link_net_capable() at the top of the operation before any attribute is parsed, matching the pattern already applied to ipgre_changelink(). Stable-tree fixes are available in commits 2abdacc, 8efb8f8, 95f45e2, 9de5518, and f8c4985.
Workarounds
- Avoid moving geneve devices into less-trusted namespaces where callers hold CAP_NET_ADMIN
- Drop CAP_NET_ADMIN from container specifications that do not require tunnel management
- Use seccomp or Landlock policies to block rtnetlink operations from workloads that should not reconfigure network devices
# Example: drop CAP_NET_ADMIN from a container to prevent changelink abuse
docker run --cap-drop=NET_ADMIN --rm -it <image>
# Example: verify running kernel against the fixed stable tags
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
