8.8
HIGH
CVSS 3.1
CVE-2026-72136
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net. Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Details
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Update the Linux kernel to enforce CAP_NET_ADMIN in the correct network namespace.
- Update the Linux kernel to the latest version.
- Apply the necessary patch for xfrm_interface.
- Ensure CAP_NET_ADMIN is checked in the correct netns.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72136.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72136 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72136
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72136 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72136 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '04c1aa57d08471b1953bf27c84ac9b3d78d71831', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'bdfd1c21d90e628a58a9de79e024cdfcbedfa15c', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '80ec68bba11f7f387c0e4099c2d7b2c84943eb99', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'e9c90756f10da334fb31552e52c61f1dba69f491', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '37b61946d278c7deb0d40ba8f2b6fc0478d61dab', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '8ca2a19a987a7d1cb4c916ed9723a1c6993b4276', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '095515d89b19b6cc19dfcdc846f97403ed1ebce3', 'versionType': 'git'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '04c1aa57d08471b1953bf27c84ac9b3d78d71831', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'bdfd1c21d90e628a58a9de79e024cdfcbedfa15c', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '80ec68bba11f7f387c0e4099c2d7b2c84943eb99', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'e9c90756f10da334fb31552e52c61f1dba69f491', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '37b61946d278c7deb0d40ba8f2b6fc0478d61dab', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '8ca2a19a987a7d1cb4c916ed9723a1c6993b4276', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '095515d89b19b6cc19dfcdc846f97403ed1ebce3', 'versionType': 'git'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '04c1aa57d08471b1953bf27c84ac9b3d78d71831', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'bdfd1c21d90e628a58a9de79e024cdfcbedfa15c', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '80ec68bba11f7f387c0e4099c2d7b2c84943eb99', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': 'e9c90756f10da334fb31552e52c61f1dba69f491', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '37b61946d278c7deb0d40ba8f2b6fc0478d61dab', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '8ca2a19a987a7d1cb4c916ed9723a1c6993b4276', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'f203b76d78092faf248db3f851840fbecf80b40e', 'lessThan': '095515d89b19b6cc19dfcdc846f97403ed1ebce3', 'versionType': 'git'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/xfrm/xfrm_interface_core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net. Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed. Added Reference https://git.kernel.org/stable/c/04c1aa57d08471b1953bf27c84ac9b3d78d71831 Added Reference https://git.kernel.org/stable/c/095515d89b19b6cc19dfcdc846f97403ed1ebce3 Added Reference https://git.kernel.org/stable/c/37b61946d278c7deb0d40ba8f2b6fc0478d61dab Added Reference https://git.kernel.org/stable/c/3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea Added Reference https://git.kernel.org/stable/c/80ec68bba11f7f387c0e4099c2d7b2c84943eb99 Added Reference https://git.kernel.org/stable/c/8ca2a19a987a7d1cb4c916ed9723a1c6993b4276 Added Reference https://git.kernel.org/stable/c/bdfd1c21d90e628a58a9de79e024cdfcbedfa15c Added Reference https://git.kernel.org/stable/c/e9c90756f10da334fb31552e52c61f1dba69f491
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.