CVE-2026-72052net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 690afc165bb314354667f67157c1a1aea7dc797a builds before 129f8939e5af683cec3a1a5edcb40a64636ad81e; from 690afc165bb314354667f67157c1a1aea7dc797a before e3724dedf57761c6de52f4d604ec74f66fd61611; from 690afc165bb314354667f67157c1a1aea7dc797a before 220162c9fedbe992da70d70f50a10da4f45f914c; 690afc165bb314354667f67157c1a1aea7dc797a builds before 1d4d8ee002083ca4ead5353662bf8362428af57f; 690afc165bb314354667f67157c1a1aea7dc797a builds before 0caa9f348f8b5356900de77b0bb89a697c4aff20; 690afc165bb314354667f67157c1a1aea7dc797a builds before 03d8843b143ebbbfaf48511922abc6e886575a61; from 690afc165bb314354667f67157c1a1aea7dc797a before c38c8b0db3c65b597e7ece317b6cb59de3d15e69; from 690afc165bb314354667f67157c1a1aea7dc797a before f00a50876d2818bd6dc86fa98b3ef360884c53c8; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e
- https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611
- https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c
- https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f
- https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20
- https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61
- https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69
- https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.