---
id: CVE-2026-68432
title: 'vxlan: require CAP_NET_ADMIN in the device netns for changelink'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vxlan: require CAP_NET_ADMIN in the device netns for changelink

  A tunnel changelink() operates on at most two netns, dev_net(dev) and
  the sticky underlay netns vxlan->…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    b95a8743e58f7efed5ddc4cb73829b66f17feab0
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    7465ade989ba84adc2bfa58bad3ca25d249f0f7a
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    0aa580a8bbbed2507b4582a1f0ef581d480d06ed
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    b3793d7dccb192ffff29894d11824db6251acdd5
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    730c7e5fea7f06e0cdf21c547222ec93234fd1d6
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    e8ad0d311e225939a9a6c745d6cc384c7364ec87
  - >-
    Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 <
    3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e
  - Linux 4.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:48:52.480523Z'
published: '2026-08-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:13.375Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68432'
references:
  - url: 'https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0'
  - url: 'https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a'
  - url: 'https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed'
  - url: 'https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5'
  - url: 'https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f'
  - url: 'https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6'
  - url: 'https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87'
  - url: 'https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e'
tags:
  - cve.org
epss: 0.0013
epssPercentile: 0.02308
ingestedAt: '2026-10-16T17:24:46.866Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: require CAP_NET_ADMIN in the device netns for changelink

A tunnel changelink() operates on at most two netns, dev_net(dev) and
the sticky underlay netns vxlan->net. They differ once the device is
created in or moved to a netns other than the one the request runs in.
The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),
so a caller privileged there but not in vxlan->net can rewrite a vxlan
device whose underlay lives in vxlan->net.

vxlan_changelink() validates and applies the new configuration against
vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the
underlay socket in that netns, so the same reasoning as the tunnel
changelink series applies here.

Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of
the op before any attribute is parsed, matching ipgre_changelink() and
the rest of the "require CAP_NET_ADMIN in the device netns for
changelink" series.

Found by 0sec automated security-research tooling (https://0sec.ai).

## Affected

- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < b95a8743e58f7efed5ddc4cb73829b66f17feab0`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < 7465ade989ba84adc2bfa58bad3ca25d249f0f7a`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < 0aa580a8bbbed2507b4582a1f0ef581d480d06ed`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < b3793d7dccb192ffff29894d11824db6251acdd5`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < 32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < 730c7e5fea7f06e0cdf21c547222ec93234fd1d6`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < e8ad0d311e225939a9a6c745d6cc384c7364ec87`
- `Linux >= 8bcdc4f3a20be949df54b67e5ae2734daabb5792 < 3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.