7.8
HIGH
CVSS 3.1
CVE-2026-52909
ip6_vti: set netns_immutable on the fallback device.
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace.
Details
INFO
Published Date :
June 19, 2026, 3:16 p.m.
Last Modified :
July 8, 2026, 3:24 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Update the Linux kernel to set netns_immutable on the fallback device.
- Apply the latest Linux kernel security updates.
- Verify the netns_immutable flag is set on fallback devices.
- Test tunnel driver behavior after update.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-52909.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-52909 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-52909
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-52909 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-52909 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.15 up to (excluding) 5.10.260 Added Reference Type kernel.org: https://git.kernel.org/stable/c/12acc977838c943636fb01e2f3087d2e4cc3b7cc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/12c65e2c7fef507551bd7b52123598a761662c01 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7f28e3948c59481f8db9c9638e204258d26b4e41 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c5dbd669db5a426b3025512322e1bf2cdbe14305 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d289d5307762d1838aaece22c6b6fcad9e8865f9 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dcdce3bc9f08026ff3739ee7339e1bef526fc5f3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ecf8904067dcba0dad86ece80874841e60317885 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/12acc977838c943636fb01e2f3087d2e4cc3b7cc Added Reference https://git.kernel.org/stable/c/12c65e2c7fef507551bd7b52123598a761662c01 Added Reference https://git.kernel.org/stable/c/7f28e3948c59481f8db9c9638e204258d26b4e41 Added Reference https://git.kernel.org/stable/c/c5dbd669db5a426b3025512322e1bf2cdbe14305 Added Reference https://git.kernel.org/stable/c/f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'ecf8904067dcba0dad86ece80874841e60317885', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'dcdce3bc9f08026ff3739ee7339e1bef526fc5f3', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'd289d5307762d1838aaece22c6b6fcad9e8865f9', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '12acc977838c943636fb01e2f3087d2e4cc3b7cc', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '7f28e3948c59481f8db9c9638e204258d26b4e41', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '12c65e2c7fef507551bd7b52123598a761662c01', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'c5dbd669db5a426b3025512322e1bf2cdbe14305', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'ecf8904067dcba0dad86ece80874841e60317885', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'dcdce3bc9f08026ff3739ee7339e1bef526fc5f3', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'd289d5307762d1838aaece22c6b6fcad9e8865f9', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'ecf8904067dcba0dad86ece80874841e60317885', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'dcdce3bc9f08026ff3739ee7339e1bef526fc5f3', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'd289d5307762d1838aaece22c6b6fcad9e8865f9', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace. Added Reference https://git.kernel.org/stable/c/d289d5307762d1838aaece22c6b6fcad9e8865f9 Added Reference https://git.kernel.org/stable/c/dcdce3bc9f08026ff3739ee7339e1bef526fc5f3 Added Reference https://git.kernel.org/stable/c/ecf8904067dcba0dad86ece80874841e60317885
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.