CVE-2026-72053

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
LinuxLinux	6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before a7d2642a50282322bc33f34ee7305f2b793df494Affected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 068ad9b85f681755f751ebab82ae98146cec163dAffected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 91571643e554ae89a91942380d5f5361fb7060a2Affected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 983cc4aa7e6f633b34c3ee743771252d7afa9a90Affected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 26544021d5c49cc6ae8a968ccb5033e6363854a4Affected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 68cadc3698c7de88966d306d12ec9c6217da228aAffected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before d49edcc65e0a37cc9b386a94415c5d6670ca8b71Affected 6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 8211a26324667980a463c069469a818e71207e02Affected
LinuxLinux	3.12Affected before 3.12Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before a7d2642a50282322bc33f34ee7305f2b793df494Affected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 068ad9b85f681755f751ebab82ae98146cec163dAffected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 91571643e554ae89a91942380d5f5361fb7060a2Affected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 983cc4aa7e6f633b34c3ee743771252d7afa9a90Affected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 26544021d5c49cc6ae8a968ccb5033e6363854a4Affected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 68cadc3698c7de88966d306d12ec9c6217da228aAffected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before d49edcc65e0a37cc9b386a94415c5d6670ca8b71Affected
6c742e714d8c282fd8f8b22d3e20b5141738c1ee to before 8211a26324667980a463c069469a818e71207e02Affected

LinuxLinux

3.12Affected
before 3.12Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.