High

CVE-2026-63921 — ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there.

Published Jul 19, 2026 · Updated Oct 16, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.18%

ahead of 7% of scored CVEs · Oct 16, 2026

Affects

Linux

CVSS base

8.8

High · 2 source(s)

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation

None

none · proof-of-concept · active

Automatable

can an attacker script the kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 94ff740a7f9ef5c010784a325dca00cbf228f941≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < df42ac708acc3399bbb6dc5ca16e0540adda7bbf≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 44d2ff7d2178503b93151140a45dfa2ad49c9906≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 1acfb7d9c6fc7e209ed7789392697e97e03edd33≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < d2236348414bdd6558385f35aa7fdc9bf5634011≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 853f6ea482dfcd3404bbef458ab4d68364eed838≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 596f6354c96a891e58c04a09cbfb7b0d1ec00dab≥ 61220ab349485d911083d0b7990ccd3db6c63297 and < 8b484efd5cb4eeef9021a661e198edc5349dacf6 and 1 more version 3.15	Vulnerable	CVE Program (cve.org) e CISA ADP

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
8.8	CVSS 3.1	High	2.0	6.0	416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database
8.8	CVSS 3.1	High	—	—	Linux via CVE Program (cve.org) e CISA ADP

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)

EPSS over time FIRST

Oct 15, 2026 → Oct 16, 2026 · 2 reading(s) · max 0.18%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.

endpoint telemetry (EDR)

Timeline

What happened to this CVE, newest first.

2026
SSVC assessment updated
Oct 16, 2026 · CVE Program (cve.org) e CISA ADP
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 15, 2026
CVSS changed · 8.8
Oct 15, 2026 · NIST National Vulnerability Database
Source status changed · → Awaiting Analysis
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Jul 19, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941
NIST National Vulnerability Database
git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011
NIST National Vulnerability Database
git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf
NIST National Vulnerability Database
git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab
NIST National Vulnerability Database
git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6
NIST National Vulnerability Database
git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906
NIST National Vulnerability Database
git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838
NIST National Vulnerability Database
git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-98866 sched/cache: Introduce task_struct->sched_cache_grp to fix UAF 7h
Unknown CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory 7h
Unknown CVE-2026-98868 dm-pcache: reject a kset that overruns its segment 7h
Unknown CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap 7h
Unknown CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth 7h
Unknown CVE-2026-98858 io_uring: fix task_work add use-after-free with SQPOLL 7h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No fixed version, patch or mitigation documented.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-63921 is "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 8.8 describes technical severity. EPSS 0.18% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.