CVE-2026-72054

Received Received - Intake

Linux Kernel CAP_NET_ADMIN Privilege Escalation in vti_changelink

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72054

EUVD

EUVD-2026-59012

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a user with CAP_NET_ADMIN privileges in one network namespace to modify a network tunnel in another namespace without proper authorization. The issue occurs because the changelink operation checks privileges only in the device's namespace, not the tunnel's namespace.

Detection Guidance

This vulnerability affects the Linux kernel's net: ip_vti module. Detection requires checking for unauthorized changes to VTI tunnels. Inspect kernel logs for suspicious changelink operations or use commands like 'ip link show' to review tunnel configurations. Look for tunnels with unexpected netns associations.

Impact Analysis

An attacker with limited privileges could exploit this to alter network tunnels, potentially disrupting network traffic or enabling further attacks. This could lead to unauthorized network access or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel network security issue. It involves improper privilege checks in the netns for device operations, which could allow unauthorized network configuration changes. However, no evidence suggests direct impacts on data protection or privacy compliance frameworks.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor tunnel configurations for unauthorized changes. Disable unused VTI tunnels until patched.

Hi! I’m here to help you understand CVE-2026-72054. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70