PT-2026-61238 · Linux · Linux
CVE-2026-63921
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
8.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6 tnl.net in vti6 siocdevprivate().
After patch 1/2 in this series, vti6 update() unlinks and relinks
the tunnel through t->net. vti6 siocdevprivate() still uses
dev net(dev) for the collision lookup. For a tunnel moved through
IFLA NET NS FD, dev net(dev) is the new netns, not t->net.
SIOCCHGTUNNEL on a migrated tunnel then runs:
net = dev net(dev) /* migrated netns /
t = vti6 locate(net, &p1, false) / misses target in t->net /
...
t = netdev priv(dev)
vti6 update(t, &p1, false) / mutates t->net's hash */
A caller in the migrated netns picks params that match a tunnel
in the creation netns. The lookup in dev net(dev) finds nothing.
vti6 update() prepends the migrated tunnel at the head of the
creation netns hash bucket for those params. Later lookups in
the creation netns resolve to the migrated device. xfrm receive
delivers the matched packets through a device the caller controls.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Switch the SIOCCHGTUNNEL path on a non fallback device to use
t->net for the lookup. The lookup now matches the netns
vti6 update() operates on.
Also add ns capable(self->net->user ns, CAP NET ADMIN) before
the lookup. The check at the top of the case is against
dev net(dev)->user ns, which after migration is the attacker's
netns. A caller there can pick params absent from self->net,
the lookup returns NULL, t becomes self, and vti6 update()
inserts the device into the creation netns hash. The new check
requires CAP NET ADMIN in the creation netns user ns too.
SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep
dev net(dev), which equals init net there.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux