CVE-2026-72054
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.
Risk Assessment
Risk of unauthorized modification of IPVTI tunnels, potentially leading to interception or redirection of network traffic.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that adds the required capability check.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.