Skip to main content

Linux Kernel EUVDEUVD-2026-59011

| CVE-2026-72053 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-7x5h-h8j3-crrp
Information Disclosure Linux Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

PR:L for CAP_NET_ADMIN in device netns; S:C because impact crosses into a separate namespace; attacker can arrange cross-namespace prerequisite using already-held capabilities.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:32 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

AnalysisAI

Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.

Technical ContextAI

The Linux kernel's IPIP encapsulation driver (net/ipip.c) exposes tunnel device attributes via the rtnetlink (RTNL) changelink interface. When ipip_changelink() is invoked, it operates against up to two distinct network namespaces: dev_net(dev) (the namespace hosting the tunnel device) and t->net (the namespace anchoring the tunnel's remote endpoint and routing). These namespaces diverge when a device has been created in or migrated between namespaces - a valid and supported kernel operation. The RTNL framework's generic changelink path verifies CAP_NET_ADMIN only against dev_net(dev), leaving t->net entirely unguarded. The upstream fix introduces a rtnl_dev_link_net_capable() gate at the entry of ipip_changelink(), enforcing capability verification across both namespaces before any attribute parsing begins. No formal CWE is assigned in the source data, but the root cause is a missing authorization check (conceptually CWE-285) - the kernel incorrectly assumes a single-namespace privilege model for a function that operates cross-namespace. The vulnerability traces to commit 6c742e714d8c282fd8f8b22d3e20b5141738c1ee, introduced approximately at Linux 3.12.

RemediationAI

Upgrade to a patched stable kernel: 6.1.178 or later for the 6.1.x branch, 6.6.145 or later for 6.6.x, 6.12.97 or later for 6.12.x, 6.18.40 or later for 6.18.x, or 7.1.5 or later for 7.1.x; upstream fix commits are documented at the kernel.org stable links in the references. Distribution-specific backport packages (Red Hat, Debian, Ubuntu, SUSE) are expected to follow. Where an immediate kernel upgrade is not possible, restrict or drop CAP_NET_ADMIN from container workloads that do not require IPIP tunnel management - note this will break legitimate container-level network interface configuration. Deploying seccomp profiles that restrict AF_NETLINK socket creation limits the rtnetlink attack surface at the cost of reduced container network diagnostics capability. If IPIP encapsulation is not in use on the affected system, blacklisting the ipip kernel module (add 'blacklist ipip' to /etc/modprobe.d/ and run modprobe -r ipip) eliminates the attack surface entirely with no operational impact to non-IPIP workloads - this is the most effective compensating control when IPIP is not required.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59011 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy