Linux Kernel CVE-2026-68432

VXLAN (Virtual eXtensible LAN, RFC 7348) is a Layer 2 overlay tunneling protocol implemented in the Linux kernel's net/vxlan/ subsystem, used extensively in Kubernetes CNI plugins, Docker networking, and OpenStack Neutron. The kernel's rtnetlink (RTNL) interface exposes changelink() operations for modifying live network device configuration. The flaw arises from the dual-namespace architecture of vxlan devices: each device tracks both dev_net(dev) - the namespace in which the device currently lives - and vxlan->net - the 'sticky' underlay namespace anchoring the UDP socket and routing context. The rtnl changelink path enforces CAP_NET_ADMIN only against dev_net(dev), omitting an equivalent check for vxlan->net. Because vxlan_changelink() internally calls vxlan_config_validate(vxlan->net, ...) and can reopen the underlay socket in vxlan->net, a caller privileged in only dev_net(dev) gains effective write access to the underlay namespace's network stack. No CWE is formally assigned, but the root cause maps to CWE-862 (Missing Authorization) across a namespace trust boundary. The fix, consistent with ipgre_changelink() and the broader 'require CAP_NET_ADMIN in device netns for changelink' kernel series, gates vxlan_changelink() with rtnl_dev_link_net_capable() before any attribute parsing. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.