CVE-2026-72055 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The Linux kernel vulnerability identified within the ip6_vti module represents a critical privilege escalation flaw rooted in insufficient access control checks during network device configuration operations. Specifically, the vti6_changelink function handles changes to Virtual Tunnel Interface version 6 devices, which operate across potentially two distinct network namespaces: the namespace associated with the physical or logical device itself and the namespace of the tunnel endpoint link. This architectural design allows for scenarios where a device is created in one network namespace but linked to an endpoint residing in another. The core technical flaw lies in the rtnl changelink path, which previously performed privilege verification exclusively against the capabilities of dev_net(dev). Consequently, if a user possesses CAP_NET_ADMIN privileges within the device's local network namespace but lacks equivalent privileges in the tunnel link's target namespace, they can successfully rewrite or reconfigure the tunnel. This bypass effectively allows an unprivileged actor to manipulate networking infrastructure that resides outside their authorized scope, undermining the isolation guarantees provided by Linux network namespaces.
From a technical perspective, this vulnerability exploits the asymmetry between device ownership and endpoint authority in virtualized networking environments. Network namespaces are designed to provide isolated views of network resources, ensuring that processes within one namespace cannot interfere with those in another unless explicitly permitted. By failing to validate CAP_NET_ADMIN against t->net, the kernel allowed state changes to propagate across these isolation boundaries without proper authorization. The operational impact is significant, as it enables unauthorized modification of tunnel configurations, which can lead to traffic interception, denial of service through misconfigured routing, or further lateral movement within a compromised system by altering network paths. This flaw effectively neutralizes the security boundary between namespaces for this specific class of devices, allowing attackers with limited local privileges to exert control over critical networking components they should not be able to access.
The remediation strategy implemented involves gating the vti6_changelink function on rtnl_dev_link_net_capable at its entry point, prior to any attribute parsing or state modification. This ensures that both the device namespace and the tunnel link namespace are validated for administrative privileges before any changes are applied. By enforcing this dual-check mechanism, the kernel restores the principle of least privilege, ensuring that users can only modify resources within namespaces where they hold appropriate authority. This fix aligns with industry standards such as CWE-269, which addresses Improper Privilege Management, and mitigates risks associated with unauthorized access to system resources. Furthermore, this type of vulnerability is relevant to the ATT&CK framework under techniques involving privilege escalation or defense evasion through network configuration manipulation, highlighting the importance of rigorous validation in kernel-level networking code to maintain systemic integrity.