A namespace admin could rewrite a tunnel that lives somewhere else
Brief
This is not the ageing-timer bug already on the site.
Notes
3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e (Doruk Tan Ozturk, 0sec.ai). Fixes: 8bcdc4f3a20b. Cc: stable. The change-link path checked admin capability only against the device’s network namespace, so a caller privileged there but not in the sticky underlay namespace could rewrite the tunnel. The fix asks whether the caller is admin in the underlay too.
The commit does not say local privilege escalation. Later confirm: CVE-2026-68432. Different SHA from the ageing-timer use-after-free b37971686ec59fb027fa4910ba16805e68fddb97. Not in 7.1.8.
Commit 3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e