Linux Kernel CVE-2026-72051

The flaw resides in ip6_tnl_changelink() within the Linux kernel's net/ipv6/ip6_tunnel.c, part of the IPv6 tunnel (ip6_tunnel) subsystem responsible for encapsulating IPv6-in-IPv6 and related tunnel types. An ip6_tunnel device maintains two potentially distinct network namespace references: dev_net(dev), the namespace where the tunnel device is logically present, and t->net, the namespace where the tunnel's link endpoint resides. These diverge when a device is created in or moved to a different netns than the one issuing the modification request. The RTNL (Routing Netlink) changelink code path, which dispatches device attribute modifications, historically validated CAP_NET_ADMIN only against dev_net(dev). Because no check existed against t->net, a caller privileged in the former but not the latter could issue rtnl changelink calls that effectively write tunnel configuration into the more privileged namespace. The fix gates ip6_tnl_changelink() on rtnl_dev_link_net_capable() at function entry, enforcing capability checks across both relevant namespaces before any attribute parsing occurs. Although CWE is listed as N/A in the input, the root cause is best characterized as CWE-863 (Incorrect Authorization) - a security boundary enforcement gap in cross-namespace privilege checks.