CVE-2026-63829

In the Linux kernel, the following vulnerability has been resolved:

net: ipgre: require CAPNET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, devnet(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.

Add rtnldevlinknetcapable() next to rtnlgetnetnscapable() in net/core/rtnetlink.c. It requires CAPNETADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.

Gate ipgrechangelink() and erspanchangelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgrenetlinkparms() sets t->collectmd before iptunnel_changelink() runs.

Commit 8b484efd5cb4 ("ip6: vti: Use ip6tnl.net in vti6siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.