Executive brief
The Linux kernel's IPIP tunneling implementation failed to properly enforce permission checks when modifying tunnel configuration across isolated network namespaces. An unprivileged user with administrative rights in one namespace could reconfigure tunnels belonging to another namespace, potentially disrupting network isolation and enabling unauthorized access to tunnel traffic or configuration.
Technical details
The vulnerability is a privilege escalation flaw in the net/ipv4/ipip.c module's ipip_changelink() function. The function operates across two network namespaces (dev_net(dev) and the tunnel's namespace t->net) but only validated CAP_NET_ADMIN capability against dev_net(dev), allowing a caller with privileges in one namespace to modify tunnels in another namespace where they lack authority. The fix adds a call to rtnl_dev_link_net_capable() at the start of ipip_changelink() to enforce capability checks in the correct namespace. No authentication or special network access is required beyond initial namespace boundary crossing. An attacker can achieve arbitrary tunnel reconfiguration including parameter modification that could redirect traffic or break network isolation.
Affected products
- Linux Linux kernel Multiple kernel versions (patch fixed in stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: advisory
- 2026-07-24: patched: Patch merged to stable branches; upstream fix commit 8211a26324667980a463c069469a818e71207e02