CVE-2026-63917
Received Received - Intake

Kernel Bug in Linux Kernel VTI6 Tunnel Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63917
EUVD
EUVD-2026-45690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a use-after-free bug occurs in the IP6 Virtual Tunnel Interface (vti6). When a vti6 tunnel is moved between network namespaces, stale entries are left in the original namespace's hash tables. Later cleanup of that namespace triggers a kernel panic due to accessing freed memory.

Detection Guidance

This vulnerability may trigger a kernel BUG at net/core/dev.c:12376 when moving a vti6 tunnel between network namespaces. Check kernel logs for messages like 'kernel BUG at net/core/dev.c:12376' or crashes during vti6 operations.

Impact Analysis

An unprivileged user with access to a user namespace (via unshare --user --map-root-user --net) could trigger this bug. On container hosts, this could allow cross-tenant attacks leading to kernel crashes and potential denial of service.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a kernel-level issue affecting network namespace handling in Linux. Compliance implications would depend on how the affected system is used in a regulated environment rather than the vulnerability itself.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Avoid moving vti6 tunnels between network namespaces until the fix is applied. Restrict unprivileged user namespace access if vti6 tunnels are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart