CVE-2026-72052 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's implementation of IPv6 GRE (Generic Routing Encapsulation) and ERSPAN (Ethernet Remote Spanning Protocol) tunneling mechanisms, specifically within the net namespace management subsystem. This security flaw affects the ip6_gre and ip6erspan network device drivers that handle tunnel configuration operations through the rtnl (route netlink) interface. The core issue manifests when network devices operate across multiple network namespaces, creating a privilege escalation vector that undermines the kernel's security model.
The technical flaw occurs in the ip6gre_changelink() and ip6erspan_changelink() functions which manage link configuration changes for IPv6 tunnel devices. These functions operate on at most two network namespaces: the device's current namespace dev_net(dev) and the tunnel's target namespace t->net. The vulnerability stems from an incomplete capability check that only validates CAP_NET_ADMIN privileges against the device's current namespace dev_net(dev) during the rtnl changelink operation. This oversight allows malicious actors who possess administrative privileges within one network namespace but lack such privileges in another to manipulate tunnels residing in different namespaces.
The operational impact of this vulnerability is significant as it enables privilege escalation attacks where an unprivileged user in one network namespace can modify or rewrite tunnel configurations that exist in a separate, more privileged namespace. This creates a scenario where attackers can potentially inject malicious network traffic, redirect communications, or compromise the integrity of network tunnels spanning multiple namespaces. The flaw particularly affects systems running complex network topologies with multiple isolated network namespaces where tunneling is extensively used for network segmentation and virtualization purposes.
The mitigation strategy involves implementing comprehensive capability checks at the entry points of both functions by gating operations through rtnl_dev_link_net_capable() before any attribute parsing occurs. This ensures that callers must possess CAP_NET_ADMIN privileges in both the device's current namespace and the target tunnel namespace before making configuration changes. The solution aligns with security best practices established by the Common Weakness Enumeration (CWE) category CWE-284 which addresses improper access control issues, and follows ATT&CK techniques related to privilege escalation through kernel vulnerabilities. This approach prevents unauthorized modifications to network tunnel configurations across namespace boundaries while maintaining legitimate administrative functionality within properly privileged contexts.
The vulnerability demonstrates a classic case of insufficient privilege validation in multi-namespace kernel operations and highlights the importance of comprehensive capability checks when managing network resources that span multiple security domains. Proper implementation of such checks ensures that kernel network subsystems maintain proper isolation between namespaces while preserving necessary administrative capabilities for legitimate system management tasks.