Executive brief
The Linux kernel's xfrm (IPsec transformation) interface implementation contains a privilege escalation flaw that allows an unprivileged user to modify virtual network interfaces in network namespaces where they lack administrative permissions. An attacker with CAP_NET_ADMIN in one network namespace can reconfigure virtual xfrm interfaces that exist in a different namespace, potentially compromising IPsec/VPN configurations and network isolation boundaries.
Technical details
The vulnerability is a privilege escalation in xfrmi_changelink() within the xfrm_interface_core.c subsystem. The root cause is incomplete authorization checking: the rtnl changelink path verifies CAP_NET_ADMIN only against dev_net(dev), but xfrmi_changelink() operates on two network namespaces—dev_net(dev) and the interface's link namespace (xi->net). An attacker privileged in one namespace but not in the other can modify interfaces that live in the second namespace. The fix adds a gating call to rtnl_dev_link_net_capable() at the top of xfrmi_changelink() before any attributes are parsed. This is a local privilege escalation requiring network namespace setup; it does not affect systems without xfrm virtual interfaces.
Affected products
- Linux Linux kernel 5.0 and later prior to 6.10.y (affected in multiple stable series; see git.kernel.org for complete branch coverage)
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-06-12: patched: Upstream fix committed as 095515d89b19b6cc19dfcdc846f97403ed1ebce3; backported to stable series
- 2026-06-17: other: Fix merged to mainline by Jakub Kicinski