The kernel bug allowed any user to attach to an existing tun/tap device that had no owner or group set without requiring the CAP_NET_ADMIN capability. Because such devices are world-consumable, an attacker could create or use a tun device to inject or intercept traffic, effectively gaining privileged network access. The flaw does not directly execute code, but it enables local privilege escalation that can be leveraged for further exploitation.

All Linux kernel installations that did not yet incorporate commit 3ca459eaba1bf, which added the necessary CAP_NET_ADMIN check for owner‑less devices. This includes Linux distributions using kernel releases before the patch was merged. Current stable kernels contain the fix, but any system running an older kernel remains vulnerable.

The vulnerability’s attack vector is local, requiring the attacker to have a user account on the affected host. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. However, the CVE’s nature—granting privileged access to tun interfaces—implies a high potential impact if leveraged. Administrators should treat the issue as a high‑risk local privilege escalation, particularly on systems that expose tun devices without owner or group assignments.