CVE-2026-72061

A flaw was found in the Linux kernel. An incorrect permission check in the ipip6_changelink() function, which manages IPv6 over IPv4 (SIT) tunnels, allows a local attacker to bypass intended security restrictions. A user with administrative capabilities (CAP_NET_ADMIN) in one network namespace (a virtualized network environment) could modify a tunnel configuration in a different network namespace where they do not have the necessary privileges. This could lead to unauthorized changes to network tunnel settings, potentially causing network disruption or unintended routing.

Red Hat has rated this vulnerability as Important because an attacker holding network administration capabilities inside an isolated container or network namespace can alter tunnel configurations belonging to a different namespace. In typical Red Hat Enterprise Linux multi-tenant environments, this boundary bypass enables unauthorized manipulation of IPv6-over-IPv4 (SIT) tunnels without requiring full host-level root privileges. Consequently, an isolated workload can compromise host or peer network routing integrity, breaking network isolation guarantees.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the sit kernel module from loading if IPv6-in-IPv4 tunneling is not required in your environment.

1. Blacklist the sit module by creating a configuration file in /etc/modprobe.d/:

# echo 'install sit /bin/true' > /etc/modprobe.d/disable-sit.conf

2. If the module is currently loaded, attempt to remove it:

# modprobe -r sit

Warning: Disabling this module prevents the creation and operation of IPv6-in-IPv4 (SIT) network tunnels. If the module is currently in use, unloading it will fail and a system restart will be required for the configuration to take effect.