1. Home
  2. Vulnerabilities
  3. CVE-2026-63921
8.8
HIGH CVSS 3.1
CVE-2026-63921
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there.

Details
INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 27, 2026, 5:44 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-63921 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Ensure proper network namespace capabilities and use the correct network namespace for tunnel lookups.
  • Apply the provided kernel patch.
  • Verify CAP_NET_ADMIN in creation netns.
  • Ensure correct netns is used for lookups.
  • Validate tunnel updates.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-63921.

URL Resource
https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33
https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906
https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab
https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838
https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6
https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941
https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011
https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-63921 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-63921 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-63921 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-63921 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 20, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '94ff740a7f9ef5c010784a325dca00cbf228f941', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'df42ac708acc3399bbb6dc5ca16e0540adda7bbf', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '44d2ff7d2178503b93151140a45dfa2ad49c9906', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '1acfb7d9c6fc7e209ed7789392697e97e03edd33', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': 'd2236348414bdd6558385f35aa7fdc9bf5634011', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '853f6ea482dfcd3404bbef458ab4d68364eed838', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '596f6354c96a891e58c04a09cbfb7b0d1ec00dab', 'versionType': 'git'}, {'status': 'affected', 'version': '61220ab349485d911083d0b7990ccd3db6c63297', 'lessThan': '8b484efd5cb4eeef9021a661e198edc5349dacf6', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ip6_vti.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there.
    Added Reference https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33
    Added Reference https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906
    Added Reference https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab
    Added Reference https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838
    Added Reference https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6
    Added Reference https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941
    Added Reference https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011
    Added Reference https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 8.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact