Cross-namespace tunnel rewrite via missing link-namespace capability check

Authorization bypass in the Linux Kernel allows local users to rewrite GRE and ERSPAN tunnels across network namespaces. The rtnetlink changelink path checks CAP_NET_ADMIN only in dev_net(dev), while ipgre_changelink() and erspan_changelink() parse attributes that update live fields for a tunnel whose link namespace can be t->net. Exploitation requires CAP_NET_ADMIN in the device namespace but not the tunnel link namespace, enabling traffic redirection, injection, disclosure, or sustained connectivity loss beyond the caller's namespace.