In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

xfrmi_changelink() operates on at most two netns, dev_net(dev) and the
interface link netns xi->net. They differ once the device is created in
or moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in xi->net can rewrite an interface that
lives in xi->net.

Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f203b76d78092faf248db3f851840fbecf80b40e affected < 04c1aa57d08471b1953bf27c84ac9b3d78d71831
f203b76d78092faf248db3f851840fbecf80b40e affected < bdfd1c21d90e628a58a9de79e024cdfcbedfa15c
f203b76d78092faf248db3f851840fbecf80b40e affected < 80ec68bba11f7f387c0e4099c2d7b2c84943eb99
f203b76d78092faf248db3f851840fbecf80b40e affected < e9c90756f10da334fb31552e52c61f1dba69f491
f203b76d78092faf248db3f851840fbecf80b40e affected < 37b61946d278c7deb0d40ba8f2b6fc0478d61dab
f203b76d78092faf248db3f851840fbecf80b40e affected < 8ca2a19a987a7d1cb4c916ed9723a1c6993b4276
f203b76d78092faf248db3f851840fbecf80b40e affected < 3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea
f203b76d78092faf248db3f851840fbecf80b40e affected < 095515d89b19b6cc19dfcdc846f97403ed1ebce3
Linux Linux affected
Version Status Constraints
4.19 affected —
0 unaffected < 4.19
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/04c1aa57d08471b1953bf27c84ac9b3d78d71831 cve-icon cve-icon
https://git.kernel.org/stable/c/095515d89b19b6cc19dfcdc846f97403ed1ebce3 cve-icon cve-icon
https://git.kernel.org/stable/c/37b61946d278c7deb0d40ba8f2b6fc0478d61dab cve-icon cve-icon
https://git.kernel.org/stable/c/3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea cve-icon cve-icon
https://git.kernel.org/stable/c/80ec68bba11f7f387c0e4099c2d7b2c84943eb99 cve-icon cve-icon
https://git.kernel.org/stable/c/8ca2a19a987a7d1cb4c916ed9723a1c6993b4276 cve-icon cve-icon
https://git.kernel.org/stable/c/bdfd1c21d90e628a58a9de79e024cdfcbedfa15c cve-icon cve-icon
https://git.kernel.org/stable/c/e9c90756f10da334fb31552e52c61f1dba69f491 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net. Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Title xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:53:11.072Z

Reserved: 2026-08-09T03:40:39.908Z

Link: CVE-2026-72136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:31.103

Modified: 2026-08-15T06:21:31.103

Link: CVE-2026-72136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T13:45:03Z

Weaknesses

No weakness.