Executive brief
The Linux kernel's IPv6 GRE (Generic Routing Encapsulation) tunnel implementation fails to properly validate administrative permissions when modifying tunnel configuration across different network namespaces. An attacker with administrative privileges in one network namespace but not in another can exploit this to reconfigure tunnels in the restricted namespace, potentially intercepting or redirecting network traffic and compromising the integrity of isolated network environments.
Technical details
The vulnerability exists in the ip6gre_changelink() and ip6erspan_changelink() functions in net/ipv6/ip6_gre.c. These functions operate across two network namespaces: dev_net(dev) and the tunnel link namespace t->net. The rtnl (rtnetlink) changelink path only checks CAP_NET_ADMIN capability against dev_net(dev), allowing a caller with privileges there but not in t->net to modify tunnel configuration in the restricted namespace. The fix adds a call to rtnl_dev_link_net_capable() at the top of both functions to gate the operations on proper capability checks in both namespaces. The vulnerability affects IPv6 GRE tunnels that have been created in or moved to different network namespaces. Network reachability to the affected system is required; no remote code execution or authentication bypass occurs, but configuration integrity is compromised.
Affected products
- Linux Linux kernel multiple versions prior to fix commit f00a50876d2818bd6dc86fa98b3ef360884c53c8
Timeline
- 2026-08-15: disclosed
- 2026-06-12: patched: Fix commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 authored