The vulnerability in the Linux kernel’s ip6_gre and ip6erspan changelink functions permits a process with CAP_NET_ADMIN in one network namespace to alter the configuration of a GRE or ERSPAN tunnel that resides in another namespace. The flaw arises because the kernel only checks the caller’s capability against the device’s own namespace, not the tunnel’s namespace. Based on the description, it is inferred that the attacker can change tunnel parameters and potentially redirect traffic or disrupt connectivity, which could elevate privileges within that namespace.

Affected systems include all installations of the Linux kernel that have not incorporated the state‑of‑the‑art patch which adds the missing capability check. As no specific version list is provided, every kernel version released prior to the fix is considered vulnerable. The issue affects the generic Linux:Linux kernel product.

The CVSS score of 8.8 indicates high severity, but the extremely low EPSS score (<1%) and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation at present. Based on the description, it is inferred that the exploit would require a local attacker who already has CAP_NET_ADMIN privileges in a namespace—typically a root or privileged process—making the attack vector local and limited to systems where namespace isolation is broken. Based on the description, it is also inferred that the missing authorization check could be abused to perform privileged network misconfigurations, which warrants immediate remediation.