CVE-2026-72136

Received Received - Intake

xfrm_interface: CAP_NET_ADMIN Requirement in changelink Operation

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net. Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72136

EUVD

EUVD-2026-58894

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper privilege checks in the xfrm_interface component. Specifically, the xfrmi_changelink() function allows users with CAP_NET_ADMIN privileges in one network namespace to modify interfaces in another namespace where they lack privileges. This occurs because the function only checks permissions in the device's network namespace but not the interface's link namespace.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges in the device's network namespace. Detection involves checking for unauthorized changes to xfrm interfaces. Use commands like 'ip link show' to list interfaces and 'dmesg | grep xfrm' to check kernel logs for related errors. Ensure only privileged users can modify these interfaces.

Impact Analysis

If exploited, this vulnerability could allow an attacker with limited privileges to modify network interfaces in a different network namespace, potentially leading to network misconfigurations, unauthorized access, or denial of service. Systems using xfrm_interface for VPNs or network virtualization could be particularly affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel privilege escalation issue requiring CAP_NET_ADMIN in specific network namespaces, which is unrelated to data protection or privacy regulations.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor network interfaces for unauthorized changes using tools like 'auditd' or 'netfilter' rules. Review user permissions in network namespaces.

Hi! I’m here to help you understand CVE-2026-72136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70