vti6_changelink() allows a caller with CAP_NET_ADMIN on the device’s net namespace to change the attributes of a tunnel that resides in a different net namespace, because the capability check only verifies the caller’s rights on the device namespace. This flaw enables an attacker who can interact with the device namespace but lacks rights in the tunnel’s namespace to rewrite tunnel parameters without proper authorization, potentially redirecting traffic or escalating privileges in the network stack.

All versions of the Linux kernel that have not yet applied the patch documented in the provided kernel commit references. The vulnerability affects the net/ip6_vti subsystem across all distributions that ship the affected kernel code.

The vulnerability is a local or privileged escalation flaw; it requires the attacker to run within a context that has CAP_NET_ADMIN on the device namespace but not on the tunnel’s namespace. No exploit has been publicly documented and the EPSS score is < 1%, indicating a low to modest likelihood of exploitation. The flaw is not yet listed in CISA’s KEV catalog. Because the required capability is non‑trivial, the risk is moderate, but any system that operates ip6_vti tunnels should treat the issue as significant. The CVSS base score of 8.8 indicates a high severity.