8.8
HIGH
CVSS 3.1
CVE-2026-72061
net: sit: require CAP_NET_ADMIN in the device netns for changelink
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipip6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed. sit was the one tunnel type not covered by the recent series that added this check to the other changelink() handlers.
Details
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Apply the Linux kernel patch to enforce CAP_NET_ADMIN for changelink operations.
- Update the Linux kernel.
- Apply the sit changelink patch.
- Enforce CAP_NET_ADMIN in netns.
- Review network device access controls.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72061.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72061 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72061
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72061 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72061 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'cb41b308e9d867725d965b291dd085028e36a480', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c5a0ae895432596b2f464172da8218e2d84e2932', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '7d139dec96691cde96cb40ed293e2d13d994fb4f', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '388ccffbd2e7e5e4271f291085a7451865705305', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c0ea1aedb37bb979e864ed7787975434bbd9db73', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '3118e97dae533fb45964b87bbed1801afcff7c65', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '99ae3248b33df94201915d9c32e7470cdf08cfcd', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '27ccb68e7cccead5d8c611665a45d23032d468b3', 'versionType': 'git'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'cb41b308e9d867725d965b291dd085028e36a480', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c5a0ae895432596b2f464172da8218e2d84e2932', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '7d139dec96691cde96cb40ed293e2d13d994fb4f', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '388ccffbd2e7e5e4271f291085a7451865705305', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c0ea1aedb37bb979e864ed7787975434bbd9db73', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '3118e97dae533fb45964b87bbed1801afcff7c65', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '99ae3248b33df94201915d9c32e7470cdf08cfcd', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '27ccb68e7cccead5d8c611665a45d23032d468b3', 'versionType': 'git'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'cb41b308e9d867725d965b291dd085028e36a480', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c5a0ae895432596b2f464172da8218e2d84e2932', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '7d139dec96691cde96cb40ed293e2d13d994fb4f', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '388ccffbd2e7e5e4271f291085a7451865705305', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': 'c0ea1aedb37bb979e864ed7787975434bbd9db73', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '3118e97dae533fb45964b87bbed1801afcff7c65', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '99ae3248b33df94201915d9c32e7470cdf08cfcd', 'versionType': 'git'}, {'status': 'affected', 'version': '5e6700b3bf98fe98d630bf9c939ad4c85ce95592', 'lessThan': '27ccb68e7cccead5d8c611665a45d23032d468b3', 'versionType': 'git'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/sit.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipip6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed. sit was the one tunnel type not covered by the recent series that added this check to the other changelink() handlers. Added Reference https://git.kernel.org/stable/c/27ccb68e7cccead5d8c611665a45d23032d468b3 Added Reference https://git.kernel.org/stable/c/3118e97dae533fb45964b87bbed1801afcff7c65 Added Reference https://git.kernel.org/stable/c/388ccffbd2e7e5e4271f291085a7451865705305 Added Reference https://git.kernel.org/stable/c/7d139dec96691cde96cb40ed293e2d13d994fb4f Added Reference https://git.kernel.org/stable/c/99ae3248b33df94201915d9c32e7470cdf08cfcd Added Reference https://git.kernel.org/stable/c/c0ea1aedb37bb979e864ed7787975434bbd9db73 Added Reference https://git.kernel.org/stable/c/c5a0ae895432596b2f464172da8218e2d84e2932 Added Reference https://git.kernel.org/stable/c/cb41b308e9d867725d965b291dd085028e36a480
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.