The Linux kernel vxlan module had a privilege validation flaw where changelink operations only checked CAP_NET_ADMIN capability against the device's network namespace (dev_net(dev)) but not against the underlay network namespace (vxlan->net). This allowed a caller privileged in dev_net(dev) but not in vxlan->net to rewrite a vxlan device configuration, including reopening the underlay socket. The vulnerability was fixed by gating vxlan_changelink() with rtnl_dev_link_net_capable() to require CAP_NET_ADMIN in the device's network namespace before parsing any attributes, consistent with other tunnel changelink implementations.

An attacker with CAP_NET_ADMIN capability in one network namespace could modify vxlan device configurations in another network namespace where they lack privileges, potentially leading to unauthorized network configuration changes. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel to require CAP_NET_ADMIN capability in the device's network namespace for vxlan changelink operations. Users should update to a kernel version that includes this fix. Patch status is not explicitly stated; check the vendor advisory or Linux kernel release notes for the exact fixed versions and apply updates accordingly.