CVE-2026-63917

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vti6 changelink() function where the kernel fails to correctly handle network namespace changes for vti6 devices. When a vti6 tunnel is moved to a different network namespace via IFLA NET NS FD, the device pointer updates to the new namespace while the tunnel structure remains linked to the creation namespace. This causes vti6 changelink() and vti6 update() to create stale entries in the creation namespace's hash. Consequently, when cleanup net() is called for that namespace, the system attempts to access freed memory, leading to a kernel BUG. This can be triggered from an unprivileged user namespace, potentially impacting cross-tenant security on container hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.