The vulnerability in the Linux kernel’s ip6_gre and ip6erspan changelink functions permits a process with CAP_NET_ADMIN in one network namespace to alter the configuration of a GRE or ERSPAN tunnel that resides in another namespace. The flaw arises because the kernel only checks the caller’s capability against the device’s own namespace, not the tunnel’s namespace. This allows the attacker to change tunnel parameters and potentially redirect traffic or disrupt connectivity, elevating their privileges within that namespace.

Affected systems include all installations of the Linux kernel that have not incorporated the state‑of‑the‑art patch which adds the missing capability check. As no specific version list is provided, every kernel version released prior to the fix is considered vulnerable. The issue affects the generic Linux:Linux kernel product.

The CVSS score of 8.8 indicates high severity, but the extremely low EPSS score (<1%) and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation at present. The exploit requires a local attacker who already has CAP_NET_ADMIN privileges in a namespace—typically a root or privileged process—so the attack vector is local and limited to systems where namespace isolation is broken. Nevertheless, the missing authorization check could be abused to perform privileged network misconfigurations, warranting immediate remediation.