The Linux kernel code that changes network interface attributes in the xfrm subsystem fails to validate that the caller possesses the CAP_NET_ADMIN capability within the namespace where the target interface resides. A process that is privileged in the device’s namespace but not in the interface’s link namespace can thus modify or replace that interface, enabling the attacker to alter routing, forwarding, or security policies without proper authorization. This represents an improper authorization flaw that grants elevated privileges beyond the intended containment of network namespaces.

All Linux kernel releases that implement the xfrm_interface path are affected, since the vulnerability information appears for the general Linux kernel family. No specific version range is supplied, meaning any kernel combination that utilizes xfrm_INTERFACE is potentially vulnerable until the code change in the provided patch is applied.

Based on the description, it is inferred that the attacker must hold CAP_NET_ADMIN in the device’s namespace but not in the interface’s link namespace, allowing unauthorized modification of that interface. The likely attack vector is local, as the vulnerability is triggered by a local change request executed by a process aware of the relevant namespace. The vulnerability enables local privilege escalation on kernels that rely on namespace isolation; the EPSS score indicates an exploitation probability of less than 1%, suggesting a low likelihood of real-world exploitation, yet the CVE is not listed in CISA KEV. The exploitation scenario is highly specific, but for those who can obtain the required privileges, it provides a privilege escalation path that can alter routing, forwarding, or security policies. The CVSS score is 8.8, indicating high severity.