Improper access control in Linux kernel - CVE-2026-72136

Vulnerability identifier: #VU143449

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72136

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

Linux kernel
openEuler
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-extra-modules

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
python3-perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
python3-perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-source - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debugsource - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160

• https://git.kernel.org/stable/c/04c1aa57d08471b1953bf27c84ac9b3d78d71831
• https://git.kernel.org/stable/c/095515d89b19b6cc19dfcdc846f97403ed1ebce3
• https://git.kernel.org/stable/c/37b61946d278c7deb0d40ba8f2b6fc0478d61dab
• https://git.kernel.org/stable/c/3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea
• https://git.kernel.org/stable/c/80ec68bba11f7f387c0e4099c2d7b2c84943eb99
• https://git.kernel.org/stable/c/8ca2a19a987a7d1cb4c916ed9723a1c6993b4276
• https://git.kernel.org/stable/c/bdfd1c21d90e628a58a9de79e024cdfcbedfa15c
• https://git.kernel.org/stable/c/e9c90756f10da334fb31552e52c61f1dba69f491

• Improper access control in Linux kernel xfrm
• openEuler 24.03 LTS SP3 update for kernel
• openEuler 24.03 LTS SP1 update for kernel