The vulnerability arises in the Linux kernel's handling of tunnel link configuration changes. When a changelink operation is invoked, the system verifies the CAP_NET_ADMIN capability only against the device's native network namespace (dev_net(dev)). If the tunnel link resides in a different network namespace (t->net), the capability check is not performed in that namespace. Consequently, a process that has CAP_NET_ADMIN in dev_net(dev) can change a GRE or ERSPAN tunnel that is located in t->net without possessing the required capability there. This results in a local privilege escalation for the process, allowing it to reconfigure tunnels that it otherwise should not be able to modify. The flaw maps to CWE‑266: Least Privilege Violation.

Any Linux kernel version compiled without the patch that adds the capability check for the tunnel link's network namespace is susceptible. No specific version numbers are provided in the CNA data; therefore, administrators should review the kernel version on systems to determine if the patch (commits adding rtnl_dev_link_net_capable()) has been applied.

The CVSS score of 8.8 indicates a high severity vulnerability that could compromise configuration integrity of the host's networking stack. The EPSS score is reported as < 1 %, implying a low probability of exploitation at the time of analysis. The flaw is not listed in CISA KEV. The likely attack vector involves a local process with CAP_NET_ADMIN in the device namespace attempting to modify a tunnel in a different namespace; based on the description, it is inferred that the exploitation requires the target tunnel to exist in another namespace. No external network interaction is necessary.