The vulnerability is a missing capability check in the IPv6 tunnel changelink function of the Linux kernel. An attacker who has CAP_NET_ADMIN in one network namespace can invoke the changelink operation to modify or replace a tunnel that resides in a different namespace, bypassing the intended access control. This flaw allows a trusted process in a privileged namespace to alter network configuration in an isolated namespace, potentially disrupting services or enabling unintended data paths.

All Linux kernel varieties that have not applied the security commits found in the advisory (commits 234cd54fc500f69db43e37de38603da617fbbeea, 2496fa0b7d180b3ad356b514e7ff93bb14e6140a, 2636d061bc237a2446a146e42dcc6563acfa7432, 7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa, d4bcc202a3530c856e1cb183384bc9cc8fddab22) are impacted. The issue surfaces whenever an IPv6 tunnel is created, moved, or accessed from a different network namespace than the one executing the changelink operation.

The flaw can be exploited locally by any process that has CAP_NET_ADMIN in the originating namespace but does not possess that capability in the target namespace. Based on the description, it is inferred that the attacker need only have local execution privileges and the ability to manipulate network namespaces, which is typically already available to administrators or compromised processes. No remote exploitation vector is documented. Although the available data does not provide a CVSS or EPSS score, the absence of a KEV listing does not diminish the potential for privilege escalation within a multi-namespace environment.