---
id: CVE-2026-72052
title: 'net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

  ip6gre_changelink() and ip6erspan_changelink() operate on at most two
  netns, dev_net(dev) and th…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    129f8939e5af683cec3a1a5edcb40a64636ad81e
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    e3724dedf57761c6de52f4d604ec74f66fd61611
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    220162c9fedbe992da70d70f50a10da4f45f914c
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    1d4d8ee002083ca4ead5353662bf8362428af57f
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    0caa9f348f8b5356900de77b0bb89a697c4aff20
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    03d8843b143ebbbfaf48511922abc6e886575a61
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    c38c8b0db3c65b597e7ece317b6cb59de3d15e69
  - >-
    Linux >= 690afc165bb314354667f67157c1a1aea7dc797a <
    f00a50876d2818bd6dc86fa98b3ef360884c53c8
  - Linux d0201d2405dac8d9b16773e97709925e397552d0
  - Linux 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a
  - Linux >= 4.19.100 < 4.20
  - Linux >= 5.4.16 < 5.5
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:50:53.707122Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:18.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72052'
references:
  - url: 'https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e'
  - url: 'https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611'
  - url: 'https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c'
  - url: 'https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f'
  - url: 'https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20'
  - url: 'https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61'
  - url: 'https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69'
  - url: 'https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.05792
ingestedAt: '2026-10-16T17:24:46.874Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

ip6gre_changelink() and ip6erspan_changelink() operate on at most two
netns, dev_net(dev) and the tunnel link netns t->net. They differ once
the device is created in or moved to a netns other than the one the
request runs in. The rtnl changelink path checks CAP_NET_ADMIN only
against dev_net(dev), so a caller privileged there but not in t->net can
rewrite a tunnel that lives in t->net.

Gate both ops on rtnl_dev_link_net_capable() at their top, before any
attribute is parsed.

## Affected

- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 129f8939e5af683cec3a1a5edcb40a64636ad81e`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < e3724dedf57761c6de52f4d604ec74f66fd61611`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 220162c9fedbe992da70d70f50a10da4f45f914c`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 1d4d8ee002083ca4ead5353662bf8362428af57f`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 0caa9f348f8b5356900de77b0bb89a697c4aff20`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < 03d8843b143ebbbfaf48511922abc6e886575a61`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < c38c8b0db3c65b597e7ece317b6cb59de3d15e69`
- `Linux >= 690afc165bb314354667f67157c1a1aea7dc797a < f00a50876d2818bd6dc86fa98b3ef360884c53c8`
- `Linux d0201d2405dac8d9b16773e97709925e397552d0`
- `Linux 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a`
- `Linux >= 4.19.100 < 4.20`
- `Linux >= 5.4.16 < 5.5`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.