CVE-2026-63917

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kernel bug, resulting in a denial of service (system crash) and potentially impacting container isolation on affected hosts.

A stale per-network-namespace VTI6 tunnel entry can remain after a VTI6 device is moved between network namespaces because the update and changelink paths use the device's current network namespace instead of the tunnel's original namespace. When the original namespace is later destroyed, cleanup_net() may access the stale entry after the associated object has been freed, resulting in a use-after-free condition.

The vulnerability is considered to require low privileges (PR:L) because an unprivileged local user can reach the affected code path by creating user and network namespaces and obtaining the required capabilities within the newly created user namespace, where unprivileged user namespaces are enabled. Host-level CAP_NET_ADMIN is therefore not required. The issue is not remotely exploitable through network traffic; exploitation requires local netlink and network-namespace operations.

Successful exploitation can cause a kernel crash and host-wide denial of service. Because the underlying flaw is a kernel use-after-free, confidentiality and integrity impacts may also be possible, although privilege escalation has not been demonstrated. The practical impact can be greater on container hosts because an unprivileged workload with access to user and network namespaces may trigger the flaw in the shared host kernel, potentially affecting other containers or tenants outside the attacker's own namespace.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ip6_vti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.