In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink… (CVE-2026-72053)
A vulnerability in the Linux kernel's ipip module allowed insufficient privilege checks when changing tunnel link attributes across network namespaces. Specifically, the function ipip_changelink() did not properly require CAP_NET_ADMIN capability in the tunnel's network namespace, allowing a caller with privileges in one namespace to modify a tunnel in another. This issue has been resolved by gating ipip_changelink() on the appropriate capability check before processing attributes.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-72053 concerns the ipip_changelink() function in the ipip module. This function operates on two network namespaces: the device's namespace and the tunnel link's namespace. Previously, the capability check for CAP_NET_ADMIN was only performed against the device's namespace, not the tunnel link's namespace. This allowed a caller with CAP_NET_ADMIN in the device's namespace but not in the tunnel's namespace to modify tunnel link attributes improperly. The fix involves gating ipip_changelink() on rtnl_dev_link_net_capable() at the start, ensuring the caller has CAP_NET_ADMIN in the tunnel's network namespace before any attribute parsing occurs.
Potential Impact
An attacker with CAP_NET_ADMIN privileges in one network namespace could potentially modify tunnel link attributes in another namespace where they lack privileges. This could lead to unauthorized network configuration changes crossing namespace boundaries, potentially impacting network isolation and security.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly enforce CAP_NET_ADMIN capability checks in the relevant network namespace before allowing changes to tunnel link attributes. Users should apply the official kernel updates that include this fix. Patch status is not explicitly provided in the input; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink… (CVE-2026-72053)
Description
A vulnerability in the Linux kernel's ipip module allowed insufficient privilege checks when changing tunnel link attributes across network namespaces. Specifically, the function ipip_changelink() did not properly require CAP_NET_ADMIN capability in the tunnel's network namespace, allowing a caller with privileges in one namespace to modify a tunnel in another. This issue has been resolved by gating ipip_changelink() on the appropriate capability check before processing attributes.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-72053 concerns the ipip_changelink() function in the ipip module. This function operates on two network namespaces: the device's namespace and the tunnel link's namespace. Previously, the capability check for CAP_NET_ADMIN was only performed against the device's namespace, not the tunnel link's namespace. This allowed a caller with CAP_NET_ADMIN in the device's namespace but not in the tunnel's namespace to modify tunnel link attributes improperly. The fix involves gating ipip_changelink() on rtnl_dev_link_net_capable() at the start, ensuring the caller has CAP_NET_ADMIN in the tunnel's network namespace before any attribute parsing occurs.
Potential Impact
An attacker with CAP_NET_ADMIN privileges in one network namespace could potentially modify tunnel link attributes in another namespace where they lack privileges. This could lead to unauthorized network configuration changes crossing namespace boundaries, potentially impacting network isolation and security.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly enforce CAP_NET_ADMIN capability checks in the relevant network namespace before allowing changes to tunnel link attributes. Users should apply the official kernel updates that include this fix. Patch status is not explicitly provided in the input; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7x5h-h8j3-crrp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-72053"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a808b78bf8831d539501ad5
Added to database: 08/15/2026, 15:53:28 UTC
Last enriched: 08/15/2026, 17:07:10 UTC
Last updated: 08/15/2026, 18:41:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.