CVE-2026-72054

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
LinuxLinux	895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 1caf737e625143c6f23c32d2b747b1a3e42e5699Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 32edf8aa297745226854eda2d96c0fac66c1bb15Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 973ead9e565423642e4533e1547b5d2c0476fb03Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 33fd93961557ec8e3e9958995b28684c5f949394Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 6d8bc0dc99472d62c57c2a3d436e6ab408592bdaAffected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 9571af2eec8023af9a1671b7f2cd4ab400011724Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 88b33ee458a6ca5fbef6c53b9dba772da69dab68Affected 895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 95cceadbfd52d7239bd730afdda0655287d77425Affected
LinuxLinux	3.15Affected before 3.15Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 1caf737e625143c6f23c32d2b747b1a3e42e5699Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 32edf8aa297745226854eda2d96c0fac66c1bb15Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 973ead9e565423642e4533e1547b5d2c0476fb03Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 33fd93961557ec8e3e9958995b28684c5f949394Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 6d8bc0dc99472d62c57c2a3d436e6ab408592bdaAffected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 9571af2eec8023af9a1671b7f2cd4ab400011724Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 88b33ee458a6ca5fbef6c53b9dba772da69dab68Affected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to before 95cceadbfd52d7239bd730afdda0655287d77425Affected

LinuxLinux

3.15Affected
before 3.15Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.