A missing privilege check in the Linux kernel IP GRE tunnel implementation could allow a local authenticated attacker to perform unauthorized network configuration changes.

The vulnerability exists in the ip_gre module. It fails to require CAP_NET_ADMIN privileges in the device network namespace during a tunnel changelink operation, allowing an authenticated local user to modify network tunnel settings without the appropriate permissions.

An attacker could leverage this flaw to redirect network traffic or perform man-in-the-middle attacks within the network namespace. With a CVSS score of 8.8, this poses a substantial risk to network integrity and confidentiality, particularly in environments utilizing containerized networking or virtualized network tunnels.

Immediate Action: Apply the latest security patches provided by your Linux distribution to update the kernel to the versions listed above.

Proactive Monitoring: Review network interface configuration logs for unauthorized changes to GRE tunnel parameters or unexpected interface modifications.

Compensating Controls: Implement strict Network Namespace isolation and ensure that users do not have elevated privileges within restricted network namespaces.

Public Exploit Available: No (exploit_available: false)

Administrators should treat this vulnerability with high urgency, especially in systems hosting multiple users or containers. Updating the kernel to the specified version is the only effective way to ensure that privilege checks are correctly enforced for tunnel operations.