CVE-2026-72051
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
| Vendor | linux |
| Product | linux |
| Ecosystems | |
| Industries | Technology |
| Published | Aug 15, 2026 |
| Last Updated | Aug 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for linux linux
Be the first to know when new high vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Linux / Linux
0bd8762824e73a3cce7b7560a97463301764b616 < 2d53ee7daabe733deb81f51d2cc90188f8ad59a1 0bd8762824e73a3cce7b7560a97463301764b616 < 82e53e7281c71e174f9f5877c566a623c637b406 0bd8762824e73a3cce7b7560a97463301764b616 < 5252db8fb604321133138c7069d6fc3fcd89cdee 0bd8762824e73a3cce7b7560a97463301764b616 < 2636d061bc237a2446a146e42dcc6563acfa7432 0bd8762824e73a3cce7b7560a97463301764b616 < 7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa 0bd8762824e73a3cce7b7560a97463301764b616 < 234cd54fc500f69db43e37de38603da617fbbeea 0bd8762824e73a3cce7b7560a97463301764b616 < d4bcc202a3530c856e1cb183384bc9cc8fddab22 0bd8762824e73a3cce7b7560a97463301764b616 < 2496fa0b7d180b3ad356b514e7ff93bb14e6140a
Linux / Linux
3.12
References
git.kernel.org: https://git.kernel.org/stable/c/2d53ee7daabe733deb81f51d2cc90188f8ad59a1 git.kernel.org: https://git.kernel.org/stable/c/82e53e7281c71e174f9f5877c566a623c637b406 git.kernel.org: https://git.kernel.org/stable/c/5252db8fb604321133138c7069d6fc3fcd89cdee git.kernel.org: https://git.kernel.org/stable/c/2636d061bc237a2446a146e42dcc6563acfa7432 git.kernel.org: https://git.kernel.org/stable/c/7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa git.kernel.org: https://git.kernel.org/stable/c/234cd54fc500f69db43e37de38603da617fbbeea git.kernel.org: https://git.kernel.org/stable/c/d4bcc202a3530c856e1cb183384bc9cc8fddab22 git.kernel.org: https://git.kernel.org/stable/c/2496fa0b7d180b3ad356b514e7ff93bb14e6140a