Improper access control in Linux kernel - CVE-2026-72052

Vulnerability identifier: #VU143542

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-72052

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

Linux kernel
openEuler
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-extra-modules

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
python3-perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
python3-perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
perf - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-source - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debugsource - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
bpftool - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel - addressed in versions 6.6.0-145.1.24.161, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160

• https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61
• https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20
• https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e
• https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f
• https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c
• https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69
• https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611
• https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8

• Improper access control in Linux kernel ipv6
• openEuler 24.03 LTS SP3 update for kernel
• openEuler 24.03 LTS SP1 update for kernel