The Linux kernel’s ip6_tnl_changelink function lacks a capability check when changing IPv6 tunnel attributes. An attacker who holds CAP_NET_ADMIN in one network namespace can invoke this operation to modify or replace a tunnel that resides in a different namespace, effectively bypassing intended access controls. This flaw enables a local privileged process to alter networking configuration in a separate, isolated namespace, potentially reconfiguring routes, exposing traffic, or disrupting services.

All Linux kernel distributions that have not applied the security commits referenced in the advisory (commit identifiers 234cd54fc500f69db43e37de38603da617fbbeea, 2496fa0b7d180b3ad356b514e7ff93bb14e6140a, 2636d061bc237a2446a146e42dcc6563acfa7432, 7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa, d4bcc202a3530c856e1cb183384bc9cc8fddab22) are affected. No specific kernel version information is included in the CNA data, so any kernel lacking these patches is at risk.

Exploitation requires local execution with CAP_NET_ADMIN in the originating namespace but not in the target namespace. The CVSS score of 8.8 reflects the high impact of privilege escalation. The EPSS score of less than 1% indicates a very low but nonzero probability of exploitation observed in the wild. The vulnerability is not listed in the CISA KEV catalog, but the lack of remote vectors means that only compromised or privileged local processes can leverage it.