The Linux kernel’s ipip changelink function incorrectly checks for the CAP_NET_ADMIN capability only in the namespace of the device interface, not in the tunnel device’s own namespace. This missing enforcement allows a caller that has network administration rights in the device’s own netns but not in the tunnel’s netns to modify tunnel settings. The vulnerability is an instance of CWE-280, representing improper access control, and can enable an attacker to reconfigure or disable tunnels, potentially routing traffic elsewhere or disrupting network connectivity.

All Linux kernel builds prior to the commit that added the capability guard are affected. Linux distributions shipping kernel versions that include the ipip driver without this patch are vulnerable. The issue applies to any configuration where an ipip tunnel device is created and moved between network namespaces, especially in multi-namespace environments such as container hosts, virtual private networking setups, or systems that use network namespaces for workload isolation.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is listed as less than 1 %, suggesting a very low probability of exploitation in the wild, and it is not included in the CISA KEV catalog. Exploitation requires local or privileged access that grants CAP_NET_ADMIN in the device’s namespace; from this position an attacker can invoke link changes that affect the tunnel’s namespace. As the flaw permits unauthorized modification of tunnel configuration, it provides a privileged escalation vector that could compromise traffic flow and network control.