CVE-2026-52909

A flaw was found in the Linux kernel, specifically within the IPv6 Virtual Tunnel Interface (ip6_vti) component. This vulnerability occurs because a critical flag, netns_immutable, is not properly set on a specific network device (ip6_vti0) when it is initialized. This oversight could allow the device to be moved between different network environments (network namespaces) within the system. Such unauthorized movement might lead to unexpected network configurations or potential security issues.

The ip6_vti per netns fallback tunnel device ip6_vti0 was not marked as netns immutable, unlike similar tunnel fallback devices. A local actor with the ability to manage links in a network namespace could move this internal device to another namespace and break the expected ownership model for per netns tunnel state. For the CVSS the PR:L is used because reliable triggering requires local namespace or link management capability such as CAP_NET_ADMIN, which can be delegated in container or user namespace setups and is not necessarily full host root. The issue is not directly network reachable and is triggered through control plane netdevice operations rather than packet traffic. Impact is mainly namespace isolation or policy bypass with possible availability impact if the fallback device lifecycle is disrupted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.