Answer in brief
CVE-2026-63917 records a High severity (CVSS 8.8) vulnerability in ip6: vti: Use ip6_tnl.net in vti6_changelink().. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=61220ab349485d911083d0b7990ccd3db6c63297 <0cdce7618464f7fb06f461e8f4ad575cb1d570f4 || >=61220ab349485d911083d0b7990ccd3db6c63297 <f5c68875e25f331e497ddfbe81e2d8163a87f136 || >=61220ab349485d911083d0b7990ccd3db6c63297 <d9c5eecdb3c740e65038651db7c686b10d76d1bc || >=61220ab349485d911083d0b7990ccd3db6c63297 <f1e89a943ee574d0f2f16246eb3f2d7330fdeb03 || >=61220ab349485d911083d0b7990ccd3db6c63297 <225b467e3b631f38be22e4b38062a1fed02fdd21 || >=61220ab349485d911083d0b7990ccd3db6c63297 <fc32be9ac2788524c6b24efd681cce7a6e731a92 || >=61220ab349485d911083d0b7990ccd3db6c63297 <ee1778ba0f5cb53be771f97017d01eb356c797bf || >=61220ab349485d911083d0b7990ccd3db6c63297 <11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe | 0cdce7618464f7fb06f461e8f4ad575cb1d570f4, f5c68875e25f331e497ddfbe81e2d8163a87f136, d9c5eecdb3c740e65038651db7c686b10d76d1bc, f1e89a943ee574d0f2f16246eb3f2d7330fdeb03, 225b467e3b631f38be22e4b38062a1fed02fdd21, fc32be9ac2788524c6b24efd681cce7a6e731a92, ee1778ba0f5cb53be771f97017d01eb356c797bf, 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe |
| Linux/Linuxgeneric | 3.15 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.
Quoted source text, attributed separately from HOL analysis.