The kernel’s VXLAN link configuration routine omitted a necessary CAP_NET_ADMIN check against the device’s own network namespace. A user that possesses the capability in one namespace can call the changelink operation and alter a VXLAN interface whose underlying socket resides in a different namespace. This provides a pathway to modify or replace tunnel endpoints, redirect traffic, or bypass isolation boundaries, granting the attacker elevated control over network traffic within the host. Based on the description, it is inferred that the attacker requires local privileged access or a process with CAP_NET_ADMIN, and the vulnerability does not provide a remote exploitation path.

All Linux kernel builds that contain the unpatched vxlan_changelink code are vulnerable. The flaw exists regardless of distribution; any system running a kernel version that predates the patch adding CAP_NET_ADMIN verification for this operation is affected. No specific vendor or version list is supplied, so all affected kernel releases should be examined.

The vulnerability carries a CVSS score of 8.8, reflecting high severity. The EPSS score is reported as less than 1%, indicating a low but nonzero chance of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. An attacker would need to run code in a namespace where CAP_NET_ADMIN is granted for the target device but not for the VXLAN underlay, requiring local privileged access or a process with the capability. The exploitation path does not require remote code execution, but once the conditions are met, a simple link‑change command can elevate privileges or subvert network segmentation. The likely attack vector is local privileged execution, inferred from the requirement for CAP_NET_ADMIN in a namespace and the lack of any mention of remote interfaces. This inference is based on the absence of remote trigger mechanisms in the supplied description.