CVE-2026-63917

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_changelink().

ip netns add ns1

ip netns add ns2

ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7

ip -n ns1 link set vti6_test netns ns2

ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9

ip netns del ns2

ip netns del ns1

[ 132.495484] ------------[ cut here ]------------

[ 132.497609] kernel BUG at net/core/dev.c:12376!

Commit 61220ab34948 ("vti6: Enable namespace changing") dropped

NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then

move through IFLA_NET_NS_FD. After the move dev_net(dev) points

at the new netns while t->net stays at the creation netns.

vti6_changelink() and vti6_update() still use dev_net(dev) and

dev_net(t->dev). They unlink from one per netns hash and relink

into another. The creation netns is left with a stale entry.

cleanup_net() of that netns later walks freed memory.

Reachable from an unprivileged user namespace (unshare --user

--map-root-user --net). Cross tenant scope on container hosts.