CVE-2026-72052

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
LinuxLinux	690afc165bb314354667f67157c1a1aea7dc797a to before 129f8939e5af683cec3a1a5edcb40a64636ad81eAffected 690afc165bb314354667f67157c1a1aea7dc797a to before e3724dedf57761c6de52f4d604ec74f66fd61611Affected 690afc165bb314354667f67157c1a1aea7dc797a to before 220162c9fedbe992da70d70f50a10da4f45f914cAffected 690afc165bb314354667f67157c1a1aea7dc797a to before 1d4d8ee002083ca4ead5353662bf8362428af57fAffected 690afc165bb314354667f67157c1a1aea7dc797a to before 0caa9f348f8b5356900de77b0bb89a697c4aff20Affected 690afc165bb314354667f67157c1a1aea7dc797a to before 03d8843b143ebbbfaf48511922abc6e886575a61Affected 690afc165bb314354667f67157c1a1aea7dc797a to before c38c8b0db3c65b597e7ece317b6cb59de3d15e69Affected 690afc165bb314354667f67157c1a1aea7dc797a to before f00a50876d2818bd6dc86fa98b3ef360884c53c8Affected d0201d2405dac8d9b16773e97709925e397552d0Affected 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8aAffected 4.19.100 to before 4.20Affected 5.4.16 to before 5.5Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

690afc165bb314354667f67157c1a1aea7dc797a to before 129f8939e5af683cec3a1a5edcb40a64636ad81eAffected
690afc165bb314354667f67157c1a1aea7dc797a to before e3724dedf57761c6de52f4d604ec74f66fd61611Affected
690afc165bb314354667f67157c1a1aea7dc797a to before 220162c9fedbe992da70d70f50a10da4f45f914cAffected
690afc165bb314354667f67157c1a1aea7dc797a to before 1d4d8ee002083ca4ead5353662bf8362428af57fAffected
690afc165bb314354667f67157c1a1aea7dc797a to before 0caa9f348f8b5356900de77b0bb89a697c4aff20Affected
690afc165bb314354667f67157c1a1aea7dc797a to before 03d8843b143ebbbfaf48511922abc6e886575a61Affected
690afc165bb314354667f67157c1a1aea7dc797a to before c38c8b0db3c65b597e7ece317b6cb59de3d15e69Affected
690afc165bb314354667f67157c1a1aea7dc797a to before f00a50876d2818bd6dc86fa98b3ef360884c53c8Affected
d0201d2405dac8d9b16773e97709925e397552d0Affected
7943bb0f06365cf5e32f3cf8a6b29eeae981fb8aAffected
4.19.100 to before 4.20Affected
5.4.16 to before 5.5Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.