[PATCH net] net: qualcomm: rmnet: require CAP_NET_ADMIN in the real device netns for changelink

[PATCH net] net: qualcomm: rmnet: require CAP_NET_ADMIN in the real device netns for changelink

[Abdifatah Suruur]

A changelink() on an rmnet device mutates the rmnet port state attached
to the real device (endpoint mux table, port->data_format and, via
rmnet_vnd_update_dev_mtu(), the real device MTU).  The real device may
live in a different netns than the rmnet device (rmnet_newlink()
resolves it in link_net), but the rtnl path only checks CAP_NET_ADMIN
against dev_net(dev).  A caller privileged only in the rmnet device's
netns can therefore rewrite the shared cellular data-path state owned by
another netns.

Gate rmnet_changelink() with rtnl_dev_link_net_capable(), matching the
"require CAP_NET_ADMIN in the device netns for changelink" series
(vxlan/geneve, CVE-2026-68432).

Fixes: 2abb5792387e ("net: qualcomm: rmnet: Allow configuration updates to existing devices")
Reported-by: Abdifatah Suruur <suruurism@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>

---
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -312,6 +312,14 @@
 	if (!rmnet_is_real_dev_registered(real_dev))
 		return -ENODEV;
 
+	/*
+	 * The rtnl path only checks CAP_NET_ADMIN against dev_net(dev),
+	 * but the port state mutated below is attached to real_dev, which
+	 * may live in a different netns.
+	 */
+	if (!rtnl_dev_link_net_capable(dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	if (data[IFLA_RMNET_MUX_ID]) {