« Volver al listado

CVE-2026-72136

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rewrite an interface that lives in xi->net.

Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escalada de privilegios local (AV:L, PR:L) en xfrm_interface que permite a un usuario con capacidades en un netns reescribir interfaz en otro netns sin CAP_NET_ADMIN, obteniendo control administrativo.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionUser Account ManagementThreat Intelligence ProgramPrivileged Account ManagementPassword PoliciesMulti-factor Authentication

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72136",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "04c1aa57d08471b1953bf27c84ac9b3d78d71831",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "bdfd1c21d90e628a58a9de79e024cdfcbedfa15c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "80ec68bba11f7f387c0e4099c2d7b2c84943eb99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "e9c90756f10da334fb31552e52c61f1dba69f491",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "37b61946d278c7deb0d40ba8f2b6fc0478d61dab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "8ca2a19a987a7d1cb4c916ed9723a1c6993b4276",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f203b76d78092faf248db3f851840fbecf80b40e",
              "lessThan": "095515d89b19b6cc19dfcdc846f97403ed1ebce3",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/xfrm/xfrm_interface_core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/xfrm/xfrm_interface_core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:31.103",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/04c1aa57d08471b1953bf27c84ac9b3d78d71831",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/095515d89b19b6cc19dfcdc846f97403ed1ebce3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/37b61946d278c7deb0d40ba8f2b6fc0478d61dab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3ba2b2ef7d6a63b190f15cfc2b4ba0fba59928ea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/80ec68bba11f7f387c0e4099c2d7b2c84943eb99",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8ca2a19a987a7d1cb4c916ed9723a1c6993b4276",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bdfd1c21d90e628a58a9de79e024cdfcbedfa15c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9c90756f10da334fb31552e52c61f1dba69f491",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink\n\nxfrmi_changelink() operates on at most two netns, dev_net(dev) and the\ninterface link netns xi->net. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in xi->net can rewrite an interface that\nlives in xi->net.\n\nGate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top,\nbefore any attribute is parsed."
    }
  ],
  "lastModified": "2026-08-17T06:18:13.443",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}