---
id: CVE-2026-72053
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ipip: require CAP_NET_ADMIN in the device netns for changelink

  ipip_changelink() operates on at most two netns, dev_net(dev) and the
  tunnel link netns t->net
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: ipip: require CAP_NET_ADMIN in the device netns for changelink

  ipip_changelink() operates on at most two netns, dev_net(dev) and the
  tunnel link netns t->net. The…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
published: '2026-08-15'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72053'
references:
  - url: 'https://git.kernel.org/stable/c/068ad9b85f681755f751ebab82ae98146cec163d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/26544021d5c49cc6ae8a968ccb5033e6363854a4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/68cadc3698c7de88966d306d12ec9c6217da228a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8211a26324667980a463c069469a818e71207e02'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/91571643e554ae89a91942380d5f5361fb7060a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/983cc4aa7e6f633b34c3ee743771252d7afa9a90'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a7d2642a50282322bc33f34ee7305f2b793df494'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d49edcc65e0a37cc9b386a94415c5d6670ca8b71'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00176
epssPercentile: 0.06248
ingestedAt: '2026-08-23T13:48:07.888Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

ipip_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.

Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.