CVE-2026-46120

A flaw was found in the Linux kernel's ip6_gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspan_changelink() function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original network namespace is destroyed, potentially resulting in a kernel bug and system instability or denial of service.

ip6erspan_changelink used dev_net(dev) instead of the cached tunnel net namespace, so after IFLA_NET_NS_FD migration the tunnel could be reinserted into the wrong per netns ip6gre hash while a stale entry remained in the original namespace. Destroying that namespace later can walk the stale entry and trigger a slab use-after-free followed by a kernel BUG in unregister_netdevice_many_notify. For the CVSS the PR:L is used for the paranoid score because the commit states this is reachable from an unprivileged user namespace using unshare with user and net namespaces, not only from full host root. The issue is not directly network reachable by packet traffic and is triggered through local netlink namespace and tunnel lifecycle operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.