Use-after-free in Linux kernel - CVE-2026-63917
Published: July 20, 2026
Vulnerability identifier: #VU138737
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63917
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.
The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.
How to mitigate CVE-2026-63917
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4
- https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe
- https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21
- https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc
- https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf
- https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03
- https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136
- https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92