PT-2026-61234 · Linux · Linux
CVE-2026-63917
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6 tnl.net in vti6 changelink().
ip netns add ns1
ip netns add ns2
ip -n ns1 link add vti6 test type vti6 remote ::1 local ::2 key 7
ip -n ns1 link set vti6 test netns ns2
ip -n ns2 link set vti6 test type vti6 remote ::3 local ::4 key 9
ip netns del ns2
ip netns del ns1
[ 132.495484] ------------[ cut here ]------------
[ 132.497609] kernel BUG at net/core/dev.c:12376!
Commit 61220ab34948 ("vti6: Enable namespace changing") dropped
NETIF F NETNS LOCAL from vti6 devices. A vti6 tunnel can then
move through IFLA NET NS FD. After the move dev net(dev) points
at the new netns while t->net stays at the creation netns.
vti6 changelink() and vti6 update() still use dev net(dev) and
dev net(t->dev). They unlink from one per netns hash and relink
into another. The creation netns is left with a stale entry.
cleanup net() of that netns later walks freed memory.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux