The vti_changelink function in the Linux kernel operates across the device’s network namespace and the tunnel’s own namespace, but it only checks for the CAP_NET_ADMIN capability in the device’s namespace. A process that holds CAP_NET_ADMIN in its own namespace can therefore modify a vti tunnel residing in a different namespace without having the same privilege there. This flaw allows the attacker to reconfigure the tunnel, redirect traffic or intercept data, effectively undermining the isolation provided by network namespaces.

All Linux kernel builds before the patch that introduces the missing CAP_NET_ADMIN check are vulnerable. The affected product is the mainline Linux kernel, along with any derivatives that have not incorporated this fix. The vulnerability is present in the network stack’s vti tunnel implementation.

The vulnerability is local and requires the attacker to possess CAP_NET_ADMIN in at least one namespace. The EPSS score is below 1% and the issue is not listed in CISA KEV. The CVSS score of 8.8 indicates high severity. Nonetheless, the ability to alter tunnel configurations in multi‑tenant or containerized environments makes the risk moderate to high. Exploitation is straightforward for a process with administrative namespace privileges and can lead to significant network disruption or data exfiltration.