CVE-2026-53075

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls<br /> <br /> /dev/ppp open is currently authorized against file-&gt;f_cred-&gt;user_ns,<br /> while unattached administrative ioctls operate on current-&gt;nsproxy-&gt;net_ns.<br /> <br /> As a result, a local unprivileged user can create a new user namespace<br /> with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,<br /> and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against<br /> an inherited network namespace.<br /> <br /> Require CAP_NET_ADMIN in the user namespace that owns the target network<br /> namespace before handling unattached PPP administrative ioctls.<br /> <br /> This preserves normal pppd operation in the network namespace it is<br /> actually privileged in, while rejecting the userns-only inherited-netns<br /> case.