CVE-2026-72051

A flaw was found in the Linux kernel's IPv6 tunnel (ip6_tunnel) handling. A local attacker, privileged in one network namespace but not another, could exploit a missing capability check in the ip6_tnl_changelink() function. This vulnerability allows the attacker to modify an IPv6 tunnel residing in a different network namespace, potentially leading to privilege escalation or unauthorized network configuration changes.

Red Hat has rated this vulnerability as Moderate impact because successful exploitation requires local authentication and administrative privileges within a segregated network namespace, such as inside a container. Under default configurations, unprivileged users do not possess the necessary network administration capabilities to interact with tunnel link properties across namespace boundaries. Consequently, risk is primarily confined to shared multi-tenant environments where network namespace management is delegated to untrusted users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.