CVE-2026-72136 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net.
Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a privilege escalation issue within the Linux kernel's IPsec implementation, specifically affecting the xfrm_interface subsystem. This flaw manifests in the xfrmi_changelink() function which handles network interface link changes for IPsec tunnel interfaces. The vulnerability stems from improper capability checking during network namespace operations, creating a potential attack vector where malicious actors could manipulate network interfaces across namespace boundaries.
The technical flaw occurs because xfrmi_changelink() operates on two distinct network namespaces - the device's current namespace dev_net(dev) and the interface link namespace xi->net. During the rtnl changelink process, the kernel only validates CAP_NET_ADMIN capability against the device's current namespace rather than checking both namespaces involved in the operation. This asymmetric validation allows an attacker with appropriate privileges in one namespace but not another to modify interfaces that exist in different network namespaces, effectively bypassing namespace isolation mechanisms.
This vulnerability directly relates to CWE-284 Access Control Issues and maps to ATT&CK technique T1068 Privilege Escalation through improper access control. The operational impact extends beyond simple privilege escalation as it compromises network namespace isolation, potentially allowing attackers to manipulate IPsec tunnel interfaces across different security domains. An attacker could leverage this to redirect traffic, bypass network policies, or establish persistent access points within networked environments.
The mitigation strategy involves implementing early capability checking through rtnl_dev_link_net_capable() at the beginning of xfrmi_changelink() before any attribute parsing occurs. This ensures that all necessary capabilities are validated against both involved network namespaces before proceeding with interface modifications. The fix enforces proper access control boundaries and prevents the scenario where namespace-specific privileges can be leveraged to manipulate interfaces in other namespaces, thereby maintaining the integrity of network namespace isolation principles that are fundamental to Linux security architecture.
The resolution aligns with established security best practices for capability-based access control and addresses a critical gap in kernel network namespace management. This change reinforces the principle of least privilege by ensuring that all interface modification operations properly validate required capabilities in the context of all affected namespaces, preventing unauthorized modifications that could compromise network security policies and isolation boundaries.