CVE-2026-72051
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.
Risk Assessment
Risk of unauthorized modification of IPv6 tunnel configurations, potentially leading to traffic interception or network disruption.
Recommendation
Apply a Linux kernel update that enforces CAP_NET_ADMIN check in the tunnel's network namespace before processing changelink attributes.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.