The kernel’s VXLAN changelink operation omitted a required CAP_NET_ADMIN check against the device’s network namespace. An attacker who holds CAP_NET_ADMIN in the dev_net(dev) namespace can invoke vxlan_changelink and modify or replace a VXLAN device whose underlying socket resides in a different namespace. This mis‑check allows the alteration of networking configuration or the installation of a malicious tunnel, giving the attacker privileged control over network traffic or the ability to bypass isolation boundaries. The vulnerability is a classic example of improper access control in kernel code, potentially leading to privilege escalation or denial of service.

All Linux kernel implementations that include the unpatched vxlan_changelink code are affected, regardless of distribution. The impact applies to any system running a kernel version that has not yet been updated to the patch that adds the missing CAP_NET_ADMIN verification. Vendors listed in the CNA record are Linux, Linux.

The CVSS score of 8.8 reflects a high severity, the EPSS score is reported as < 1%, indicating a low chance of real‑world exploitation today, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the missing privilege check is a high‑severity flaw, as it permits a user with limited privileges in one namespace to modify network devices in another. Exploitation requires the attacker to run within a namespace that has CAP_NET_ADMIN for the target device but not for the underlying VXLAN namespace; once this condition is met, a simple command to change link settings can be used to elevate privileges or to compromise network segmentation. The attack vector is local and requires access to a privileged shell or a service running with the necessary capability, but the bug does not need remote code execution to achieve its effect.