SB20260816477 - Improper access control in Linux kernel ipv6

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260816477

SB20260816477 - Improper access control in Linux kernel ipv6

Published: August 16, 2026

Security Bulletin ID SB20260816477
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.


Remediation

Install update from vendor's website.

References