CVE-2026-72054

A flaw was found in the Linux kernel's ip_vti component. An attacker with CAP_NET_ADMIN privileges in one network namespace (netns) but not in another, can exploit an insufficient capability check in the vti_changelink() function. This allows them to rewrite a Virtual Tunnel Interface (VTI) tunnel that resides in the second network namespace, leading to unauthorized modification of network configurations and potential traffic redirection.

vti_changelink could modify a VTI tunnel that belongs to t net when the caller only has CAP_NET_ADMIN in dev_net(dev). This creates a cross namespace authorization bypass after a VTI device is created in or moved to a different network namespace than the request context. For the CVSS the PR:L is used for the paranoid score because CAP_NET_ADMIN in a reduced namespace, container root, or delegated network admin context is not equivalent to full host administrator control. Impact can include unauthorized tunnel parameter changes, traffic redirection, policy bypass, or tunnel disruption across namespace boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ip_vti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.