CVE-2026-72061
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipip6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed. sit was the one tunnel type not covered by the recent series that added this check to the other changelink() handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72061
EUVD
EUVD-2026-59019

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing capability check in the sit (IPv6-in-IPv4) tunnel device configuration. The ipip6_changelink() function allows users with CAP_NET_ADMIN in one network namespace to modify tunnel settings in another namespace where they lack privileges. This could let unprivileged users alter network tunnel configurations they should not have access to.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges in the network namespace where the tunnel device resides. Detection involves checking for unauthorized changes to SIT (IPv6-in-IPv4) tunnel configurations. Inspect active tunnels with 'ip tunnel show' or 'ip -6 tunnel show'. Review audit logs for CAP_NET_ADMIN usage in unexpected namespaces. No direct commands detect exploitation but monitoring for unauthorized tunnel modifications is key.

Impact Analysis

If exploited, this flaw could allow attackers with limited privileges to manipulate network tunnel settings, potentially disrupting network traffic or enabling further attacks. Systems using sit tunnels are at risk if untrusted users have CAP_NET_ADMIN in any network namespace.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized network modifications, potentially violating data integrity or confidentiality requirements in GDPR or HIPAA. Organizations must ensure proper access controls to prevent such privilege escalation.

Mitigation Strategies

Apply the latest Linux kernel update to patch this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor tunnel configurations for unauthorized changes. If immediate patching isn't possible, limit access to network namespace modification tools and review tunnel configurations regularly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart