An unprivileged user can create a new user namespace and obtain CAP_NET_ADMIN only within that namespace. This capability is then incorrectly applied to PPP administration ioctls (PPPIOCNEWUNIT, PPPIOCATTACH, PPPIOCATTCHAN) that target an inherited network namespace. The missing check allows the user to perform privileged PPP operations on a network namespace they are not actually privileged in, effectively granting local privilege escalation. The weakness is an authorization flaw that permits unauthorized access to administrative functionality.

All Linux kernel implementations that shipped before the fix commit in the kernel. The affected code path resides in the PPP driver for /dev/ppp, which is part of the generic kernel source tree. No specific version list is provided, so any kernel prior to the commit that introduced CAP_NET_ADMIN enforcement is vulnerable.

The vulnerability is exploitable on any system where the user can use CLONE_NEWUSER to create a user namespace. Because it requires only local access and does not need network connectivity, the attacker must be able to run code on the target machine. The EPSS score is not available, but the lack of restriction on user namespace creation gives this flaw significant potential for exploitation. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no widely known active exploitation at the time of this analysis.