{"id":"CVE-2026-72055","title":"net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink\n\nvti6_changelink() operates on at most two netns, dev_net(dev) and the\ntunnel link netns t->net. …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f5254e7766b4ac02b66b2ccef896cd278503cb11","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < ef897249dc957089e6f7f11ceea699e093ad51bd","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < c64b9ae7eb97e81d54b792910a3aeafd92566c79","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < 0b2f9c908f930ec4be17d389723f9a202d6a883c","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f97e93ebf2f9b8ef3b87f7a9371255e84d151587","Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < e2ac3b242c37dff323a964962e43854f4b1a2b79","Linux 3.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:51:02.327568Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:18.538Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72055","references":[{"url":"https://git.kernel.org/stable/c/f5254e7766b4ac02b66b2ccef896cd278503cb11"},{"url":"https://git.kernel.org/stable/c/ef897249dc957089e6f7f11ceea699e093ad51bd"},{"url":"https://git.kernel.org/stable/c/f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba"},{"url":"https://git.kernel.org/stable/c/c64b9ae7eb97e81d54b792910a3aeafd92566c79"},{"url":"https://git.kernel.org/stable/c/b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf"},{"url":"https://git.kernel.org/stable/c/0b2f9c908f930ec4be17d389723f9a202d6a883c"},{"url":"https://git.kernel.org/stable/c/f97e93ebf2f9b8ef3b87f7a9371255e84d151587"},{"url":"https://git.kernel.org/stable/c/e2ac3b242c37dff323a964962e43854f4b1a2b79"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.05784,"ingestedAt":"2026-10-16T17:24:46.874Z","slug":"CVE-2026-72055","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink\n\nvti6_changelink() operates on at most two netns, dev_net(dev) and the\ntunnel link netns t->net. They differ once the device is created in or\nmoved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t->net can rewrite a tunnel that\nlives in t->net.\n\nGate vti6_changelink() on rtnl_dev_link_net_capable() at its top,\nbefore any attribute is parsed.\n\n## Affected\n\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f5254e7766b4ac02b66b2ccef896cd278503cb11`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < ef897249dc957089e6f7f11ceea699e093ad51bd`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < c64b9ae7eb97e81d54b792910a3aeafd92566c79`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < 0b2f9c908f930ec4be17d389723f9a202d6a883c`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < f97e93ebf2f9b8ef3b87f7a9371255e84d151587`\n- `Linux >= 61220ab349485d911083d0b7990ccd3db6c63297 < e2ac3b242c37dff323a964962e43854f4b1a2b79`\n- `Linux 3.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}