The vulnerability allows an attacker who has CAP_NET_ADMIN in one network namespace to change configuration of an IP 6 GRE or ERSPAN tunnel that resides in a different network namespace without having sufficient privileges there. By calling ip6gre_changelink() or ip6erspan_changelink() the attacker can rewrite tunnel attributes, potentially hijacking traffic or creating privilege escalation paths. The flaw stems from an improper capability check—CAP_NET_ADMIN is verified only against the device’s own namespace, not the namespace of the tunnel link.

All Linux kernel releases that have not incorporated the patch removing this weakness. The issue is present in the generic Linux:Linux kernel product; no specific version list is provided, so all affected kernel versions before the update should be considered at risk.

The CVSS score is not provided, and EPSS is not available; the vulnerability is not listed in CISA’s KEV catalog. The exploit requires the attacker to already possess CAP_NET_ADMIN in the device’s netns, implying a local attacker with root or CAP_NET_ADMIN privileges in that namespace may trick the kernel into reconfiguring a tunnel in another namespace. Because the flaw involves a missing capability check, a successful exploitation would let the attacker modify tunnel parameters—leading to traffic interception or denial of service—without raising obvious audit flags.