CVE-2026-63921

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vti6 siocdevprivate() function where the use of dev net(dev) for collision lookups during tunnel migration via IFLA NET NS FD allows a tunnel to be incorrectly linked. An unprivileged user in a user namespace can manipulate tunnel parameters to insert a migrated tunnel into the hash bucket of the creation network namespace. This allows xfrm receive to deliver matched packets through a device controlled by the attacker, potentially enabling cross-tenant impact on container hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.