CVE-2026-72051

Received Received - Intake

Linux Kernel CAP_NET_ADMIN Privilege Escalation in ip6_tunnel

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72051

EUVD

EUVD-2026-59009

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a user with CAP_NET_ADMIN privileges in one network namespace to modify network tunnel settings in another namespace without proper authorization. The issue occurs because the function ip6_tnl_changelink() only checks privileges in the device's namespace but not in the tunnel's namespace.

Detection Guidance

This vulnerability involves improper privilege checks in the Linux kernel's ip6_tunnel module. Detection requires checking for unauthorized changes to IPv6 tunnel configurations. Inspect kernel logs for suspicious netlink operations or unauthorized CAP_NET_ADMIN usage in tunnel contexts. Commands like 'dmesg | grep ip6_tunnel' or 'journalctl -k | grep ip6_tunnel' may reveal anomalies.

Impact Analysis

An attacker with limited privileges could exploit this to alter network tunnel configurations, potentially disrupting network traffic or enabling further attacks by manipulating routing or network settings.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it pertains to a Linux kernel network subsystem issue requiring CAP_NET_ADMIN privileges. Compliance implications would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel patches to address the improper privilege check in ip6_tnl_changelink(). Restrict CAP_NET_ADMIN capabilities to trusted users only. Monitor network configurations for unauthorized tunnel modifications. Ensure firewalls or network policies prevent untrusted users from modifying IPv6 tunnel settings.

Hi! I’m here to help you understand CVE-2026-72051. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70