{"id":"CVE-2026-72052","revision":"23c2235f41dd4329b99d4fbcceb5c77d","records":[{"revision":"23c2235f41dd4329b99d4fbcceb5c77d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72052","aliases":[],"title":"net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nip6gre_changelink() and ip6erspan_changelink() operate on at most two\nnetns, dev_net(dev) and the tunnel link netns t->net. They differ once\nthe device is created in or moved to a netns other than the one the\nrequest runs in. The rtnl changelink path checks CAP_NET_ADMIN only\nagainst dev_net(dev), so a caller privileged there but not in t->net can\nrewrite a tunnel that lives in t->net.\n\nGate both ops on rtnl_dev_link_net_capable() at their top, before any\nattribute is parsed.","state":0,"publishedAt":"2026-08-15T05:52:09.194+00:00","modifiedAt":"2026-10-19T21:19:24.924+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ip6_gre.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"129f8939e5af683cec3a1a5edcb40a64636ad81e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"e3724dedf57761c6de52f4d604ec74f66fd61611\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"220162c9fedbe992da70d70f50a10da4f45f914c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"1d4d8ee002083ca4ead5353662bf8362428af57f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"0caa9f348f8b5356900de77b0bb89a697c4aff20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"03d8843b143ebbbfaf48511922abc6e886575a61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"c38c8b0db3c65b597e7ece317b6cb59de3d15e69\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"690afc165bb314354667f67157c1a1aea7dc797a\",\n                            \"lessThan\": \"f00a50876d2818bd6dc86fa98b3ef360884c53c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0201d2405dac8d9b16773e97709925e397552d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7943bb0f06365cf5e32f3cf8a6b29eeae981fb8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.19.100\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.16\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/ip6_gre.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e","https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611","https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c","https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f","https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20","https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61","https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69","https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72052","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72052","identifiers":["CVE-2026-72052"]},"retained":false,"historicalAffected":[]}],"coverage":[]}