CVE-2026-72136
Description
A flaw was found in the Linux kernel's xfrm_interface component. A local attacker with specific network administration privileges in one network namespace could exploit this vulnerability to modify the configuration of a network interface in a different network namespace where they are not authorized. This could lead to unauthorized changes to network settings or privilege escalation.
Statement
xfrm_interface changelink missed a capability check against the interface link network namespace. A caller with CAP_NET_ADMIN in dev_net(dev) but not in xi net could modify an XFRM interface that logically belongs to another network namespace after the device was created in or moved across namespaces. For the CVSS the PR:L is used because the attacker needs limited network administration capability in one namespace, but not full administrative control of the target namespace being modified. The issue is not directly network reachable and is triggered through local rtnetlink control plane operations. Impact is unauthorized cross namespace network configuration modification, with possible disruption or policy impact for XFRM/IPsec interfaces.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | None | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
