CVE-2026-53075

Description

In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067 https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8 https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54 https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532

Frequently Asked Questions

What is CVE-2026-53075? +

In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-53075? +

CVE-2026-53075 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0018, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-53075? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.