Answer in brief
CVE-2026-68432 records a Unknown severity vulnerability in vxlan: require CAP_NET_ADMIN in the device netns for changelink. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <b3793d7dccb192ffff29894d11824db6251acdd5 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <730c7e5fea7f06e0cdf21c547222ec93234fd1d6 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <e8ad0d311e225939a9a6c745d6cc384c7364ec87 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e | b3793d7dccb192ffff29894d11824db6251acdd5, 32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f, 730c7e5fea7f06e0cdf21c547222ec93234fd1d6, e8ad0d311e225939a9a6c745d6cc384c7364ec87, 3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e |
| Linux/Linuxgeneric | 4.11 | Not reported |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net. vxlan_changelink() validates and applies the new configuration against vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here. Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68432 records a Unknown severity vulnerability in vxlan: require CAP_NET_ADMIN in the device netns for changelink. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <b3793d7dccb192ffff29894d11824db6251acdd5 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <730c7e5fea7f06e0cdf21c547222ec93234fd1d6 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <e8ad0d311e225939a9a6c745d6cc384c7364ec87 || >=8bcdc4f3a20be949df54b67e5ae2734daabb5792 <3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e | b3793d7dccb192ffff29894d11824db6251acdd5, 32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f, 730c7e5fea7f06e0cdf21c547222ec93234fd1d6, e8ad0d311e225939a9a6c745d6cc384c7364ec87, 3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e |
| Linux/Linuxgeneric | 4.11 | Not reported |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net. vxlan_changelink() validates and applies the new configuration against vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here. Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of the op before any attribute is parsed, matching ipgre_changelink() and the rest of the "require CAP_NET_ADMIN in the device netns for changelink" series. Found by 0sec automated security-research tooling (https://0sec.ai).
Quoted source text, attributed separately from HOL analysis.