CVE-2026-72052

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 690afc165bb314354667f67157c1a1aea7dc797a, < 129f8939e5af683cec3a1a5edcb40a64636ad81e; >= 690afc165bb314354667f67157c1a1aea7dc797a, < e3724dedf57761c6de52f4d604ec74f66fd61611; >= 690afc165bb314354667f67157c1a1aea7dc797a, < 220162c9fedbe992da70d70f50a10da4f45f914c; >= 690afc165bb314354667f67157c1a1aea7dc797a, < 1d4d8ee002083ca4ead5353662bf8362428af57f; >= 690afc165bb314354667f67157c1a1aea7dc797a, < 0caa9f348f8b5356900de77b0bb89a697c4aff20; >= 690afc165bb314354667f67157c1a1aea7dc797a, < 03d8843b143ebbbfaf48511922abc6e886575a61; >= 690afc165bb314354667f67157c1a1aea7dc797a, < c38c8b0db3c65b597e7ece317b6cb59de3d15e69; >= 690afc165bb314354667f67157c1a1aea7dc797a, < f00a50876d2818bd6dc86fa98b3ef360884c53c8; d0201d2405dac8d9b16773e97709925e397552d0; 7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a; >= 4.19.100, < 4.20; >= 5.4.16, < 5.5
LinuxLinux5.5

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-720538.8In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipCVE-2026-720548.8In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-720558.8In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-72056In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create_quCVE-2026-720578.2In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_haCVE-2026-72058In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probeCVE-2026-72059In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx_cldmCVE-2026-72067.3A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/eCVE-2026-72060In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64(CVE-2026-720618.8In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipiCVE-2026-72062In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bCVE-2026-72063In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegra_gpio_directi
CVE-2026-72052: High severity, CVSS 8.8 | Vulnix