{"id":"CVE-2026-72052","title":"net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nip6gre_changelink() and ip6erspan_changelink() operate on at most two\nnetns, dev_net(dev) and th…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 129f8939e5af683cec3a1a5edcb40a64636ad81e","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < e3724dedf57761c6de52f4d604ec74f66fd61611","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 220162c9fedbe992da70d70f50a10da4f45f914c","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 1d4d8ee002083ca4ead5353662bf8362428af57f","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 0caa9f348f8b5356900de77b0bb89a697c4aff20","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 03d8843b143ebbbfaf48511922abc6e886575a61","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < c38c8b0db3c65b597e7ece317b6cb59de3d15e69","Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < f00a50876d2818bd6dc86fa98b3ef360884c53c8","Linux d0201d2405dac8d9b16773e97709925e397552d0","Linux 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a","Linux >= 4.19.100 < 4.20","Linux >= 5.4.16 < 5.5","Linux 5.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:50:53.707122Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:18.082Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72052","references":[{"url":"https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e"},{"url":"https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611"},{"url":"https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c"},{"url":"https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f"},{"url":"https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20"},{"url":"https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61"},{"url":"https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69"},{"url":"https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.05783,"ingestedAt":"2026-10-16T17:24:46.874Z","slug":"CVE-2026-72052","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nip6gre_changelink() and ip6erspan_changelink() operate on at most two\nnetns, dev_net(dev) and the tunnel link netns t->net. They differ once\nthe device is created in or moved to a netns other than the one the\nrequest runs in. The rtnl changelink path checks CAP_NET_ADMIN only\nagainst dev_net(dev), so a caller privileged there but not in t->net can\nrewrite a tunnel that lives in t->net.\n\nGate both ops on rtnl_dev_link_net_capable() at their top, before any\nattribute is parsed.\n\n## Affected\n\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 129f8939e5af683cec3a1a5edcb40a64636ad81e`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < e3724dedf57761c6de52f4d604ec74f66fd61611`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 220162c9fedbe992da70d70f50a10da4f45f914c`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 1d4d8ee002083ca4ead5353662bf8362428af57f`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 0caa9f348f8b5356900de77b0bb89a697c4aff20`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 03d8843b143ebbbfaf48511922abc6e886575a61`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < c38c8b0db3c65b597e7ece317b6cb59de3d15e69`\n- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < f00a50876d2818bd6dc86fa98b3ef360884c53c8`\n- `Linux d0201d2405dac8d9b16773e97709925e397552d0`\n- `Linux 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a`\n- `Linux >= 4.19.100 < 4.20`\n- `Linux >= 5.4.16 < 5.5`\n- `Linux 5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}