Improper access control in Linux kernel - CVE-2026-63921
Published: July 20, 2026
Vulnerability identifier: #VU138726
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63921
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to redirect packets across network namespaces.
The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.
Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.
How to mitigate CVE-2026-63921
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33
- https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906
- https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab
- https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838
- https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6
- https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941
- https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011
- https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf