CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
net: ip6tunnel: require CAPNETADMIN in the device netns for changelink
ip6tnlchangelink() operates on at most two netns, devnet(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Gate ip6tnlchangelink() on rtnldevlinknetcapable() at its top, before any attribute is parsed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On the Linux kernel net: ip6_tunnel changelink path (ip6_tnl_changelink), enforce CAP_NET_ADMIN against the tunnel device netns (t->net) so that changelink operations are limited to the request’s and device’s relevant netns as described in the resolution.
Linux kernel (net: ip6_tunnel) CAP_NET_ADMIN check for ip6_tnl_changelink() = Require CAP_NET_ADMIN in tunnel device netns t->net (in addition to dev_net(dev) as applicable) for changelink operations
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72051?
CVE-2026-72051 has a risk score of 43, indicating a moderate severity level.
How do I fix CVE-2026-72051?
To resolve CVE-2026-72051, ensure that the kernel is updated to a version that includes the fix for the vulnerability.
What systems are affected by CVE-2026-72051?
CVE-2026-72051 affects the Linux kernel specifically related to the ip6_tunnel functionality.
What does CVE-2026-72051 affect in the Linux kernel?
CVE-2026-72051 impacts the ability to change device parameters via the ip6_tunnel interface without proper permissions.
Is there a workaround for CVE-2026-72051?
Currently, the recommended approach is to update the Linux kernel to a patched version as there is no established workaround.