Re: [PATCH net v2 0/2] vxlan, geneve: require CAP_NET_ADMIN in the device netns for changelink

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Thu, 16 Jul 2026 22:34:58 +0200 you wrote:

The recent series "require CAP_NET_ADMIN in the device netns for
changelink" (8165f7ff57d9..27ccb68e7ccc) added rtnl_dev_link_net_capable()
and gated the eight IP tunnel drivers (ip_gre, ipip, ip_vti, ip6_tunnel,
ip6_gre, ip6_vti, sit, xfrm_interface). VXLAN and GENEVE share the exact
same shape but were not covered: both store the underlay netns sticky at
newlink (vxlan->net / geneve->net) and their changelink() operates on that
netns, while the generic RTM_NEWLINK path only checks CAP_NET_ADMIN against
dev_net(dev). Once such a device is created in or moved to another netns,
a caller privileged in dev_net(dev) but not in the underlay netns can
reconfigure the tunnel'"'"'s underlay.

[...]

Here is the summary with links:
  - [net,v2,1/2] vxlan: require CAP_NET_ADMIN in the device netns for changelink
    https://git.kernel.org/netdev/net/c/3a61bd9637f3
  - [net,v2,2/2] geneve: require CAP_NET_ADMIN in the device netns for changelink
    https://git.kernel.org/netdev/net/c/8efb8f8bbb35

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html