Executive brief
The Linux kernel's IP VTI (Virtual Tunnel Interface) implementation fails to properly validate user permissions when modifying tunnel configurations across network namespaces. An attacker with administrative privileges in one network namespace but not in another can modify VTI tunnels they should not have access to, potentially disrupting network isolation and enabling unauthorized network configuration changes.
Technical details
The vulnerability is a privilege escalation flaw in the VTI (Virtual Tunnel Interface) implementation's vti_changelink() function. The function operates on two network namespaces: the device namespace (dev_net(dev)) and the tunnel link namespace (t->net). When these differ—such as when a device is created in or moved to a different namespace—the kernel only validates CAP_NET_ADMIN capability against the device's namespace, not the tunnel's namespace. This allows a privileged user in one namespace to reconfigure VTI tunnels that exist in another namespace where they lack privileges. The fix adds a capability check using rtnl_dev_link_net_capable() before any tunnel attributes are parsed. No evidence of active exploitation in the wild is reported.
Affected products
- Linux Linux kernel Multiple versions (patched in upstream 95cceadbfd52d7239bd730afdda0655287d77425)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Stable kernel patches committed by Greg Kroah-Hartman