CVE-2026-72053

Received Received - Intake

Linux Kernel CAP_NET_ADMIN Privilege Escalation in IPIP Tunnel

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72053

EUVD

EUVD-2026-59011

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a user with CAP_NET_ADMIN privileges in one network namespace to modify an IP-in-IP tunnel in another network namespace without proper authorization. The changelink operation checks privileges only in the device's network namespace, not the tunnel's, enabling unauthorized changes.

Detection Guidance

This vulnerability involves improper privilege checks in the Linux kernel's ipip_changelink function. Detection requires checking for unauthorized network namespace modifications involving IPIP tunnels. Inspect kernel logs for suspicious CAP_NET_ADMIN usage in tunnel operations. Use commands like 'dmesg | grep -i ipip' or 'journalctl -k | grep -i ipip' to review relevant logs.

Impact Analysis

An attacker with limited privileges could exploit this to alter network tunnels, potentially disrupting network traffic, bypassing security controls, or enabling further attacks on the system. This could lead to data leaks or service disruptions if misused.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network subsystem issue requiring CAP_NET_ADMIN privileges. Compliance impacts would depend on system configuration and misuse rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel security patches immediately. Restrict CAP_NET_ADMIN privileges to trusted users only. Monitor network namespace changes and tunnel configurations for anomalies. Disable unused IPIP tunnel interfaces if not required.

Hi! I’m here to help you understand CVE-2026-72053. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70