CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
net: ip6vti: require CAPNETADMIN in the device netns for changelink
vti6changelink() operates on at most two netns, devnet(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Gate vti6changelink() on rtnldevlinknetcapable() at its top, before any attribute is parsed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72055?
CVE-2026-72055 has a risk score of 40.
How do I fix CVE-2026-72055?
To fix CVE-2026-72055, ensure that the appropriate capabilities are set in the device netns when using vti6_changelink.
What is the impact of CVE-2026-72055?
The impact of CVE-2026-72055 includes potential unauthorized changes to tunnel link configurations due to insufficient privilege checks.
Which component is affected by CVE-2026-72055?
CVE-2026-72055 affects the net subsystem in the Linux kernel, specifically the vti6_changelink function.
When was CVE-2026-72055 published?
CVE-2026-72055 was published on August 15, 2026.