CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

vti_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.

Gate vti_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.

The Linux kernel CVE team has assigned CVE-2026-72054 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 5.10.261 with commit 1caf737e625143c6f23c32d2b747b1a3e42e5699
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 5.15.212 with commit 32edf8aa297745226854eda2d96c0fac66c1bb15
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 6.1.178 with commit 973ead9e565423642e4533e1547b5d2c0476fb03
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 6.6.145 with commit 33fd93961557ec8e3e9958995b28684c5f949394
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 6.12.97 with commit 6d8bc0dc99472d62c57c2a3d436e6ab408592bda
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 6.18.40 with commit 9571af2eec8023af9a1671b7f2cd4ab400011724
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 7.1.5 with commit 88b33ee458a6ca5fbef6c53b9dba772da69dab68
	Issue introduced in 3.15 with commit 895de9a3488abcdd186680f0af3cce7f2d4d4a6e and fixed in 7.2-rc1 with commit 95cceadbfd52d7239bd730afdda0655287d77425

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72054
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/ip_vti.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1caf737e625143c6f23c32d2b747b1a3e42e5699
	https://git.kernel.org/stable/c/32edf8aa297745226854eda2d96c0fac66c1bb15
	https://git.kernel.org/stable/c/973ead9e565423642e4533e1547b5d2c0476fb03
	https://git.kernel.org/stable/c/33fd93961557ec8e3e9958995b28684c5f949394
	https://git.kernel.org/stable/c/6d8bc0dc99472d62c57c2a3d436e6ab408592bda
	https://git.kernel.org/stable/c/9571af2eec8023af9a1671b7f2cd4ab400011724
	https://git.kernel.org/stable/c/88b33ee458a6ca5fbef6c53b9dba772da69dab68
	https://git.kernel.org/stable/c/95cceadbfd52d7239bd730afdda0655287d77425