CVE-2026-72052

A flaw was found in the Linux kernel's ip6_gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities (CAP_NET_ADMIN) across different network namespaces. This allows a local attacker, who has CAP_NET_ADMIN in one network namespace but not in the tunnel's network namespace, to modify the tunnel's configuration. This could lead to unauthorized changes to network tunnel settings.

This vulnerability is rated as Important because an attacker with administrative capabilities inside an unprivileged user or network namespace can bypass container boundaries to modify tunnel configurations across other network namespaces. By exploiting insufficient namespace verification in IPv6 GRE and ERSPAN link management, a local user can reconfigure tunnels belonging to the host or other tenants, potentially disrupting communications or intercepting network traffic. The exposure is heightened in multi-tenant environments where unprivileged container creation is permitted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If IPv6 GRE or IP-ERSpan tunnels are not in use, their respective kernel modules (ip6_gre and ip6erspan) can be blacklisted to prevent exploitation. Create a file such as /etc/modprobe.d/disable-ip6gre.conf with the following content:

install ip6_gre /bin/true
install ip6erspan /bin/true

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This mitigation may impact network functionality if these tunnel types are actively used.