CVE-2026-72055 - Vulnerability Details

- net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

vti6_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.

Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerable function vti6_changelink() operates on the network namespace of the device and the tunnel link. The kernel currently checks the CAP_NET_ADMIN capability only against the device’s namespace. An attacker who can gain CAP_NET_ADMIN on the device’s namespace but not on the tunnel’s namespace can alter the tunnel’s configuration, redirect traffic, or otherwise manipulate the network stack without proper authorization.

Affected Systems

All Linux kernel versions that include the net/ip6_vti code and have not yet incorporated the fix referenced in the provided kernel commit list. Distributions shipping the affected kernel code are affected.

Risk and Exploitability

The flaw is a local or privileged escalation vulnerability requiring the attacker to possess CAP_NET_ADMIN in the device’s namespace but not in the tunnel’s namespace. No publicly documented exploit exists and the EPSS score of < 1% indicates a low yet non‑zero likelihood of exploitation. The CVSS base score of 8.8 signals high severity, and the vulnerability is not listed in CISA KEV.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< f5254e7766b4ac02b66b2ccef896cd278503cb11
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< ef897249dc957089e6f7f11ceea699e093ad51bd
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< c64b9ae7eb97e81d54b792910a3aeafd92566c79
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< 0b2f9c908f930ec4be17d389723f9a202d6a883c
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< f97e93ebf2f9b8ef3b87f7a9371255e84d151587
`61220ab349485d911083d0b7990ccd3db6c63297`	affected	< e2ac3b242c37dff323a964962e43854f4b1a2b79

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[61220ab349485d911083d0b7990ccd3db6c63297,f5254e7766b4ac02b66b2ccef896cd278503cb11)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,ef897249dc957089e6f7f11ceea699e093ad51bd)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,c64b9ae7eb97e81d54b792910a3aeafd92566c79)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,0b2f9c908f930ec4be17d389723f9a202d6a883c)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,f97e93ebf2f9b8ef3b87f7a9371255e84d151587)`	affected	code_commit	—
`[61220ab349485d911083d0b7990ccd3db6c63297,e2ac3b242c37dff323a964962e43854f4b1a2b79)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.15`	affected	generic	—
`[0,3.15)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that incorporates the fix from the referenced commit or upgrade to a distribution kernel that includes the patch.
If a kernel upgrade cannot be performed immediately, remove or restrict the CAP_NET_ADMIN capability from processes in the device’s network namespace to prevent unauthorized tunnel modification; this is a temporary workaround.
Disable or relocate ip6_vti tunnels that are not needed so that only trusted processes in the appropriate namespace can manage them.

Generated by OpenCVE AI on October 20, 2026 at 12:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00151.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0b2f9c908f930ec4be17d389723f9a202d6a883c
https://git.kernel.org/stable/c/b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf
https://git.kernel.org/stable/c/c64b9ae7eb97e81d54b792910a3aeafd92566c79
https://git.kernel.org/stable/c/e2ac3b242c37dff323a964962e43854f4b1a2b79
https://git.kernel.org/stable/c/ef897249dc957089e6f7f11ceea699e093ad51bd
https://git.kernel.org/stable/c/f5254e7766b4ac02b66b2ccef896cd278503cb11
https://git.kernel.org/stable/c/f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba
https://git.kernel.org/stable/c/f97e93ebf2f9b8ef3b87f7a9371255e84d151587
https://lore.kernel.org/linux-cve-announce/2026081516-CVE-2026-72055-41c4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72055
https://www.cve.org/CVERecord?id=CVE-2026-72055

History

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-862

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-270
References		https://lore.kernel.org/linux-cve-announce/2026081516-CVE-2026-72055-41c4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72055 https://www.cve.org/CVERecord?id=CVE-2026-72055
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-269 CWE-284

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-269 CWE-284

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Title		net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b2f9c908f930ec4be17d389723f9a202d6a883c https://git.kernel.org/stable/c/b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf https://git.kernel.org/stable/c/c64b9ae7eb97e81d54b792910a3aeafd92566c79 https://git.kernel.org/stable/c/e2ac3b242c37dff323a964962e43854f4b1a2b79 https://git.kernel.org/stable/c/ef897249dc957089e6f7f11ceea699e093ad51bd https://git.kernel.org/stable/c/f5254e7766b4ac02b66b2ccef896cd278503cb11 https://git.kernel.org/stable/c/f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba https://git.kernel.org/stable/c/f97e93ebf2f9b8ef3b87f7a9371255e84d151587

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:11.413Z

Updated: 2026-10-19T21:19:25.382Z

Reserved: 2026-08-09T03:40:39.903Z

Link: CVE-2026-72055

Vulnrichment

Updated: 2026-10-16T15:51:03.911Z

NVD

Status : Received

Published: 2026-08-15T06:21:14.890

Modified: 2026-10-19T22:17:24.623

Link: CVE-2026-72055

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72055 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T13:00:12Z

Weaknesses

CWE-270
Privilege Context Switching Error
CWE-862
Missing Authorization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object