CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
net: sit: require CAPNETADMIN in the device netns for changelink
ipip6changelink() operates on at most two netns, devnet(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Gate ipip6changelink() on rtnldevlinknetcapable() at its top, before any attribute is parsed. sit was the one tunnel type not covered by the recent series that added this check to the other changelink() handlers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel netns capability check so that for the sit tunnel type changelink path enforces CAP_NET_ADMIN in the device netns (t->net), not only CAP_NET_ADMIN in dev_net(dev), matching the resolved change.
Linux kernel (net: sit / tunnel link netns) CAP_NET_ADMIN check for changelink = Require CAP_NET_ADMIN in the device netns (t->net) for changelink operations (sit tunnel type)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72061?
The severity of CVE-2026-72061 is rated at 40.
How do I fix CVE-2026-72061?
To fix CVE-2026-72061, ensure that the system is updated to a version of the Linux kernel that addresses this vulnerability.
What does CVE-2026-72061 affect?
CVE-2026-72061 affects the Linux kernel's handling of the CAP_NET_ADMIN capability in network namespaces.
Who is impacted by CVE-2026-72061?
Users and administrators operating the Linux kernel who utilize network namespaces and tunneling features may be impacted by CVE-2026-72061.
What are the potential consequences of CVE-2026-72061?
The potential consequences of CVE-2026-72061 may include unauthorized configuration changes to network devices within a specific namespace.