CVE-2026-72136

A flaw was found in the Linux kernel's xfrm_interface component. A local attacker with specific network administration privileges in one network namespace could exploit this vulnerability to modify the configuration of a network interface in a different network namespace where they are not authorized. This could lead to unauthorized changes to network settings or privilege escalation.

xfrm_interface changelink missed a capability check against the interface link network namespace. A caller with CAP_NET_ADMIN in dev_net(dev) but not in xi net could modify an XFRM interface that logically belongs to another network namespace after the device was created in or moved across namespaces. For the CVSS the PR:L is used because the attacker needs limited network administration capability in one namespace, but not full administrative control of the target namespace being modified. The issue is not directly network reachable and is triggered through local rtnetlink control plane operations. Impact is unauthorized cross namespace network configuration modification, with possible disruption or policy impact for XFRM/IPsec interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.