CVE-2026-72051

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink

ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0bd8762824e73a3cce7b7560a97463301764b616, < 2d53ee7daabe733deb81f51d2cc90188f8ad59a1; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 82e53e7281c71e174f9f5877c566a623c637b406; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 5252db8fb604321133138c7069d6fc3fcd89cdee; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 2636d061bc237a2446a146e42dcc6563acfa7432; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 234cd54fc500f69db43e37de38603da617fbbeea; >= 0bd8762824e73a3cce7b7560a97463301764b616, < d4bcc202a3530c856e1cb183384bc9cc8fddab22; >= 0bd8762824e73a3cce7b7560a97463301764b616, < 2496fa0b7d180b3ad356b514e7ff93bb14e6140a
LinuxLinux3.12

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-720528.8In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-720538.8In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipCVE-2026-720548.8In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-720558.8In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-72056In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create_quCVE-2026-720578.2In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_haCVE-2026-72058In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probeCVE-2026-72059In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx_cldmCVE-2026-72067.3A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/eCVE-2026-72060In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64(CVE-2026-720618.8In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipiCVE-2026-72062In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The b
CVE-2026-72051: High severity, CVSS 8.8 | Vulnix