The vulnerability resides in the ipip6_changelink routine within the Linux kernel's sit (IPv6‑over‑IPv4) tunnel driver. When a tunnel is created or moved, the routine may operate on two distinct network namespaces—the namespace of the device and that of the tunnel link. The kernel performs the CAP_NET_ADMIN check only against the device’s namespace, not the tunnel’s. An attacker who possesses CAP_NET_ADMIN in the device namespace but not in the tunnel namespace can therefore alter or replace the tunnel’s configuration. This capability misuse permits privileged actions on resources outside the attacker’s intended namespace, constituting a privilege escalation flaw.

This flaw affects all Linux kernel builds that include the sit tunnel driver. No specific kernel version is enumerated in the advisory; the vulnerability persists until the kernel commit that gates the capability check in ipip6_changelink is merged. Systems running unpatched kernels that expose sit tunnels to users with CAP_NET_ADMIN are thus affected.

The CVSS score of 8.8 signals high severity, reflecting the potential for unauthorized configuration changes. The EPSS score of < 1% indicates a low probability of exploitation in the wild. Remote or local exploitation would require a process with CAP_NET_ADMIN in the caller’s network namespace; it is likely that such privilege is granted to users who need network configuration capabilities. The vulnerability is not included in the CISA KEV catalog.