CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved:
xfrm: xfrminterface: require CAPNETADMIN in the device netns for changelink
xfrmichangelink() operates on at most two netns, devnet(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net.
Gate xfrmichangelink() on rtnldevlinknetcapable() at its top, before any attribute is parsed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Adjust xfrm_interface changelink handling so CAP_NET_ADMIN is checked against the device’s netns (xi->net) rather than only dev_net(dev), per the resolved change: “require CAP_NET_ADMIN in the device netns for changelink”.
Linux kernel CAP_NET_ADMIN check in xfrm_interface changelink path = Require CAP_NET_ADMIN in the device netns (xi->net) for changelink
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72136?
CVE-2026-72136 has a risk rating of 40.
How do I fix CVE-2026-72136?
To mitigate CVE-2026-72136, ensure that CAP_NET_ADMIN capabilities are properly configured for the device net namespace.
What does CVE-2026-72136 affect?
CVE-2026-72136 affects the xfrm_interface in the Linux kernel.
When was CVE-2026-72136 published?
CVE-2026-72136 was published on August 15, 2026.
What is the main issue described in CVE-2026-72136?
CVE-2026-72136 addresses a requirement for CAP_NET_ADMIN for the changelink operation in the xfrm interface.