Executive brief
A vulnerability in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) could allow a local user to cause a system crash. The issue occurs when network tunnels are moved between different isolated network environments (namespaces), leading to memory corruption. This can be triggered by unprivileged users in containerized environments, potentially affecting the stability of the host system.
Technical details
A vulnerability exists in net/ipv6/ip6_vti.c where the vti6_changelink and vti6_update functions incorrectly use the current network namespace of the device instead of the creation namespace. When a vti6 tunnel is moved to a new namespace via IFLA_NET_NS_FD, the internal tunnel structure retains a reference to the original namespace while the device pointer updates. This mismatch causes stale entries in the network namespace hash tables, leading to a use-after-free or kernel BUG during namespace cleanup. The flaw is exploitable by an unprivileged user with CAP_NET_ADMIN in a user namespace. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux kernel v5.15+
Timeline
- 2026-05-21: disclosed: Vulnerability reported and fix authored
- 2026-07-19: advisory: CVE-2026-63917 published by NVD
References
- https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4
- https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe
- https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21
- https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc
- https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf
- https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03
- https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136