CVE-2026-68432

A flaw was found in the Linux kernel's VXLAN (Virtual Extensible LAN) implementation. A local attacker, with CAP_NET_ADMIN (network administration capability) in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the configuration of a VXLAN device whose underlying network interface resides in a different network namespace where the attacker lacks the necessary privileges, potentially leading to unauthorized network configuration changes.

Red Hat has evaluated this vulnerability as having an Important severity impact because it enables an authenticated local attacker to bypass network namespace boundaries and alter the state of underlying tunnel devices without proper authorization. In containerized environments or multi-tenant deployments where users possess administrative capabilities within unprivileged or isolated namespaces, this flaw compromises network isolation across tenants and host environments. Systems that do not deploy VXLAN interfaces or do not permit unprivileged namespace creation have significantly lower exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.