CVE-2026-72054

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ip vti module where the vti changelink() function does not properly verify permissions across different network namespaces (netns). The system only checks for CAP NET ADMIN privileges against the device network namespace dev net(dev), ignoring the tunnel link network namespace t->net. This allows a user with privileges in the device namespace, but lacking them in the tunnel link namespace, to rewrite a tunnel residing in t->net.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.