CVE-2026-72136
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the xfrm_interface module lacks a CAP_NET_ADMIN requirement in the interface's network namespace during changelink operations. A caller privileged only in one namespace can modify an interface in another namespace, breaking isolation.
Risk Assessment
Missing proper permission checks may allow an unauthorized user to change network interface configurations in other namespaces, potentially leading to security breaches.
Recommendation
Apply the patch from the Linux kernel update that adds rtnl_dev_link_net_capable() check at the top of xfrmi_changelink() to require CAP_NET_ADMIN in the appropriate namespace.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net. Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.