CVE-2026-63921

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

After patch 1/2 in this series, vti6_update() unlinks and relinks

the tunnel through t->net. vti6_siocdevprivate() still uses

dev_net(dev) for the collision lookup. For a tunnel moved through

IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.

SIOCCHGTUNNEL on a migrated tunnel then runs:

net = dev_net(dev) /* migrated netns */

t = vti6_locate(net, &p1, false) /* misses target in t->net */

...

t = netdev_priv(dev)

vti6_update(t, &p1, false) /* mutates t->net's hash */

A caller in the migrated netns picks params that match a tunnel

in the creation netns. The lookup in dev_net(dev) finds nothing.

vti6_update() prepends the migrated tunnel at the head of the

creation netns hash bucket for those params. Later lookups in

the creation netns resolve to the migrated device. xfrm receive

delivers the matched packets th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References