The vulnerability arises when a caller with CAP_NET_ADMIN privilege in one network namespace can invoke geneve change operations that affect a Geneve device whose underlying network namespace is different. The command path only checks the capability against the device’s namespace, not the device’s own namespace, allowing the attacker to reconfigure or replace a Geneve tunnel that resides in another namespace. This flaw can lead to unauthorized alteration of network tunnel settings, which may be exploited to redirect traffic, insert malicious nodes, or disrupt network connectivity. The weakness is a type of improper privilege management (CWE‑266).

Any Linux system running an unpatched Linux kernel that implements Geneve tunnelling is potentially affected. No specific kernel release versions are provided, but the flaw exists prior to the fix committed in this patch. Users should assume all active kernel versions before the update are vulnerable until they upgrade.

The exploit requires local access to a network namespace where the attacker can run privileged commands and has CAP_NET_ADMIN only in that namespace, not in the Geneve device’s namespace. No public exploitation has been reported. The EPSS score indicates a very low exploitation probability (< 1%). The flaw permits unauthorized configuration changes, making the impact significant, especially in multi‑tenant or segregated networking environments. With a CVSS score of 8.8, the risk is high, and the vulnerability is not listed in CISA’s KEV catalog.