CVE-2026-63829

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and

the tunnel link netns t->net. They differ once the device is created in

or moved to a netns other than the one the request runs in. The rtnl

changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a

caller privileged there but not in t->net can rewrite a tunnel that

lives in t->net.

Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in

net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is

skipped when the link netns is dev_net(dev), where the rtnl path already

checked it. The other patches in this series use the same helper.

Gate ipgre_changelink() and erspan_changelink() with it, at the top of

the op before any attribute is parsed, because the parsers update live

tunnel fields first. ipgre_netlink_parms() sets t->collect_md before

i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References