In the Linux kernel, the following vulnerability has been resolved:

net: sit: require CAP_NET_ADMIN in the device netns for changelink

ipip6_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.

Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed. sit was the one tunnel type not covered
by the recent series that added this check to the other changelink()
handlers.

https://git.kernel.org/stable/c/27ccb68e7cccead5d8c611665a45d23032d468b3

https://git.kernel.org/stable/c/3118e97dae533fb45964b87bbed1801afcff7c65

https://git.kernel.org/stable/c/388ccffbd2e7e5e4271f291085a7451865705305

https://git.kernel.org/stable/c/7d139dec96691cde96cb40ed293e2d13d994fb4f

https://git.kernel.org/stable/c/99ae3248b33df94201915d9c32e7470cdf08cfcd

https://git.kernel.org/stable/c/c0ea1aedb37bb979e864ed7787975434bbd9db73

https://git.kernel.org/stable/c/c5a0ae895432596b2f464172da8218e2d84e2932

https://git.kernel.org/stable/c/cb41b308e9d867725d965b291dd085028e36a480

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/sit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"cb41b308e9d867725d965b291dd085028e36a480","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"c5a0ae895432596b2f464172da8218e2d84e2932","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"7d139dec96691cde96cb40ed293e2d13d994fb4f","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"388ccffbd2e7e5e4271f291085a7451865705305","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"c0ea1aedb37bb979e864ed7787975434bbd9db73","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"3118e97dae533fb45964b87bbed1801afcff7c65","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"99ae3248b33df94201915d9c32e7470cdf08cfcd","versionType":"git","status":"affected"},{"version":"5e6700b3bf98fe98d630bf9c939ad4c85ce95592","lessThan":"27ccb68e7cccead5d8c611665a45d23032d468b3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/sit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.11","status":"affected"},{"version":"0","lessThan":"3.11","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]