The Linux kernel vulnerability CVE-2026-63829 involved the ip_gre module's changelink operation, which modifies GRE tunnel parameters. The changelink() function operates across two network namespaces: the device's netns and the tunnel link's netns. Previously, the kernel only checked CAP_NET_ADMIN capability in the device's netns, allowing a caller privileged there but not in the tunnel's netns to modify tunnel parameters improperly. The fix introduced a new helper function, rtnl_dev_link_net_capable(), to enforce CAP_NET_ADMIN checks in the tunnel's netns as well. This check is applied early in the changelink operation to prevent unauthorized modifications. The patch aligns the RTM_NEWLINK path with prior ioctl path checks, closing the privilege gap.

An attacker with CAP_NET_ADMIN privileges in one network namespace but not in the tunnel's network namespace could modify GRE tunnel parameters in the other namespace. This could lead to unauthorized network configuration changes within the tunnel's namespace, potentially affecting network isolation or traffic flow. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to require CAP_NET_ADMIN capability checks in both the device and tunnel network namespaces during GRE tunnel changelink operations. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.