Executive brief
A vulnerability in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) could allow a fallback network device to be moved between network namespaces. The Linux kernel is the core software that manages computer hardware and system resources. If exploited, this could lead to unintended network configurations or potential isolation bypasses in containerized environments.
Technical details
The vti6_init_net() function in net/ipv6/ip6_vti.c fails to set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). This allows the fallback device to be moved to another network namespace, which is inconsistent with other tunnel drivers like ip6_tunnel or sit. An attacker with sufficient local privileges could potentially manipulate network namespace isolation. The issue has been resolved by explicitly setting the netns_immutable flag to true during device initialization. Patches are available in stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 3.15 to 6.18.36, 7.0.13
Timeline
- 2026-06-08: other: Patch authored by Eric Dumazet
- 2026-06-19: disclosed: CVE published
- 2026-06-19: patched: Fixes merged into stable branches