diff --git a/third_party/go/patches/netlink-permhwaddr.patch b/third_party/go/patches/netlink-permhwaddr.patch
new file mode 100644
index 0000000..cedc9b0
--- /dev/null
+++ b/third_party/go/patches/netlink-permhwaddr.patch
@@ -0,0 +1,36 @@
+diff --git a/link.go b/link.go
+index 8e6b09e..fcbecfc 100644
+--- a/link.go
++++ b/link.go
+@@ -50,7 +50,9 @@ type LinkAttrs struct {
+ 	GROMaxSize   uint32
+ 	Vfs          []VfInfo // virtual functions available on link
+ 	Group        uint32
+-	Slave        LinkSlave
++
++	PermHardwareAddr net.HardwareAddr
++	Slave            LinkSlave
+ }
+ 
+ // LinkSlave represents a slave device.
+diff --git a/link_linux.go b/link_linux.go
+index cc80fb6..8681c75 100644
+--- a/link_linux.go
++++ b/link_linux.go
+@@ -2018,6 +2018,16 @@ func LinkDeserialize(hdr *unix.NlMsghdr, m []byte) (Link, error) {
+ 			base.NumRxQueues = int(native.Uint32(attr.Value[0:4]))
+ 		case unix.IFLA_GROUP:
+ 			base.Group = native.Uint32(attr.Value[0:4])
++		case unix.IFLA_PERM_ADDRESS:
++			var nonzero bool
++			for _, b := range attr.Value {
++				if b != 0 {
++					nonzero = true
++				}
++			}
++			if nonzero {
++				base.PermHardwareAddr = attr.Value[:]
++			}
+ 		}
+ 	}
+ 
diff --git a/third_party/go/repositories.bzl b/third_party/go/repositories.bzl
index 74570be..e3a5cdc 100644
--- a/third_party/go/repositories.bzl
+++ b/third_party/go/repositories.bzl
@@ -4927,6 +4927,11 @@
         replace = "github.com/monogon-dev/netlink",
         sum = "h1:y05BDqZ6q3if6pYBHJcnQRUd92ihzBEJde/S4fpKEAM=",
         version = "v0.0.0-20230125113930-88977c3ff4b3",
+        patch_args = ["-p1"],
+        patches = [
+            # Going upstream as https://github.com/vishvananda/netlink/pull/850
+            "//third_party/go/patches:netlink-permhwaddr.patch",
+        ],
     )
     go_repository(
         name = "com_github_vishvananda_netns",