CVE-2026-63921

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect network traffic intended for other parts of the system or other containers, leading to unauthorized information disclosure or denial of service across different tenants on a container host.

This vulnerability is rated as an Important severity impact because unprivileged local attackers operating inside containers can cross tenant boundaries and hijack traffic routing in shared hosting environments. By taking advantage of unprivileged user and network namespaces enabled by default on standard Red Hat Enterprise Linux installations, an attacker can misroute tunnel packets from the initial namespace. While exploitation requires local execution within a namespace rather than direct remote access, the resulting cross-tenant network disruption and eavesdropping justify the Important classification over a lower severity level.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.