CVE-2026-63917
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Description
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to a fixed version.
- Ensure proper netns handling in vti6_changelink and vti6_update.
- Review network device migration logic.
- Apply the fix for stale network namespace entries.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63917.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63917 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63917
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63917 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63917 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '0cdce7618464f7fb06f461e8f4ad575cb1d570f4', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'f5c68875e25f331e497ddfbe81e2d8163a87f136', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'd9c5eecdb3c740e65038651db7c686b10d76d1bc', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'f1e89a943ee574d0f2f16246eb3f2d7330fdeb03', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '225b467e3b631f38be22e4b38062a1fed02fdd21', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'fc32be9ac2788524c6b24efd681cce7a6e731a92', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'ee1778ba0f5cb53be771f97017d01eb356c797bf', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Added Reference https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4 Added Reference https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe Added Reference https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21 Added Reference https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc Added Reference https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf Added Reference https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03 Added Reference https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136 Added Reference https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92