Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026071947-CVE-2026-63917-4a8f@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:67471 https://access.redhat.com/errata/RHSA-2026:67471
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:68532 https://access.redhat.com/errata/RHSA-2026:68532
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:68531 https://access.redhat.com/errata/RHSA-2026:68531
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:68570 https://access.redhat.com/errata/RHSA-2026:68570
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:74174 https://access.redhat.com/errata/RHSA-2026:74174
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:75560 https://access.redhat.com/errata/RHSA-2026:75560
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:77216 https://access.redhat.com/errata/RHSA-2026:77216
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:77217 https://access.redhat.com/errata/RHSA-2026:77217
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:77218 https://access.redhat.com/errata/RHSA-2026:77218
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:77301 https://access.redhat.com/errata/RHSA-2026:77301
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:80908 https://access.redhat.com/errata/RHSA-2026:80908
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:82860 https://access.redhat.com/errata/RHSA-2026:82860