CVE-2026-68432

In the Linux kernel, the following vulnerability has been resolved:

vxlan: require CAPNETADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, devnet(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAPNETADMIN only against devnet(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net.

vxlanchangelink() validates and applies the new configuration against vxlan->net (vxlanconfig_validate(vxlan->net, ...)) and can reopen the underlay socket in that netns, so the same reasoning as the tunnel changelink series applies here.

Gate vxlanchangelink() with rtnldevlinknetcapable(), at the top of the op before any attribute is parsed, matching ipgrechangelink() and the rest of the "require CAPNETADMIN in the device netns for changelink" series.

Found by 0sec automated security-research tooling (https://0sec.ai).