Linux Kernel CVE-2026-72061

The Linux kernel SIT driver (net/ipv6/sit.c) implements IPv6-in-IPv4 tunneling and exposes a changelink handler, ipip6_changelink(), invoked via the rtnetlink interface when tunnel attributes are modified. A SIT tunnel carries two namespace references: dev_net(dev), the namespace owning the network device, and t->net, the link namespace the tunnel was configured to use. These diverge when the device is created in or subsequently moved to a different netns. The rtnl changelink path performs a CAP_NET_ADMIN check only against dev_net(dev); because ipip6_changelink() did not additionally gate on rtnl_dev_link_net_capable() for t->net, a caller privileged in dev_net(dev) but not in t->net could overwrite tunnel state living in t->net. The fix, applied consistently with a prior hardening series covering ipip, GRE, and other tunnel types, adds an rtnl_dev_link_net_capable() check at the top of ipip6_changelink() before any attribute is parsed. No CWE is formally assigned, but the root cause maps to CWE-863 (Incorrect Authorization) - a capability check that is valid but incomplete, covering only one of two relevant namespace contexts.