CVE-2026-63917

ip6: vti: Use ip6_tnl.net in vti6_changelink().

State: Published
Severity: 8.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_changelink().

ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376!

Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns.

vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory.

Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	61220ab349485d911083d0b7990ccd3db6c63297 to before 0cdce7618464f7fb06f461e8f4ad575cb1d570f4Affected 61220ab349485d911083d0b7990ccd3db6c63297 to before f5c68875e25f331e497ddfbe81e2d8163a87f136Affected 61220ab349485d911083d0b7990ccd3db6c63297 to before d9c5eecdb3c740e65038651db7c686b10d76d1bcAffected 61220ab349485d911083d0b7990ccd3db6c63297 to before f1e89a943ee574d0f2f16246eb3f2d7330fdeb03Affected 61220ab349485d911083d0b7990ccd3db6c63297 to before 225b467e3b631f38be22e4b38062a1fed02fdd21Affected 61220ab349485d911083d0b7990ccd3db6c63297 to before fc32be9ac2788524c6b24efd681cce7a6e731a92Affected 61220ab349485d911083d0b7990ccd3db6c63297 to before ee1778ba0f5cb53be771f97017d01eb356c797bfAffected 61220ab349485d911083d0b7990ccd3db6c63297 to before 11b326fb0a374f4654f9be22d0f0f7abd9f7d3feAffected
LinuxLinux	3.15Affected before 3.15Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

61220ab349485d911083d0b7990ccd3db6c63297 to before 0cdce7618464f7fb06f461e8f4ad575cb1d570f4Affected
61220ab349485d911083d0b7990ccd3db6c63297 to before f5c68875e25f331e497ddfbe81e2d8163a87f136Affected
61220ab349485d911083d0b7990ccd3db6c63297 to before d9c5eecdb3c740e65038651db7c686b10d76d1bcAffected
61220ab349485d911083d0b7990ccd3db6c63297 to before f1e89a943ee574d0f2f16246eb3f2d7330fdeb03Affected
61220ab349485d911083d0b7990ccd3db6c63297 to before 225b467e3b631f38be22e4b38062a1fed02fdd21Affected
61220ab349485d911083d0b7990ccd3db6c63297 to before fc32be9ac2788524c6b24efd681cce7a6e731a92Affected
61220ab349485d911083d0b7990ccd3db6c63297 to before ee1778ba0f5cb53be771f97017d01eb356c797bfAffected
61220ab349485d911083d0b7990ccd3db6c63297 to before 11b326fb0a374f4654f9be22d0f0f7abd9f7d3feAffected

LinuxLinux

3.15Affected
before 3.15Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.