The vulnerability in the Linux kernel involved the vti6_siocdevprivate() function using dev_net(dev) for tunnel device collision lookups after a tunnel had been migrated to a different network namespace via IFLA_NET_NS_FD. This caused lookups to fail in the migrated namespace and incorrectly insert the migrated tunnel device into the creation namespace's hash bucket. Consequently, packets could be delivered through a device controlled by an attacker in a different network namespace. The patch changes the lookup to use t->net (the tunnel's original network namespace) and adds a capability check requiring CAP_NET_ADMIN in the creation namespace's user namespace, preventing unprivileged users from exploiting this cross-namespace tunnel manipulation.

An attacker with access to an unprivileged user namespace and network namespace (e.g., via unshare with user and net namespaces) could manipulate IPv6 virtual tunnel devices to cause packet delivery through a device they control in a different network namespace. This represents a cross-tenant scope issue on container hosts, potentially allowing unauthorized packet interception or redirection across network namespaces.

A patch has been applied to the Linux kernel that corrects the network namespace used in tunnel device lookups and adds capability checks requiring CAP_NET_ADMIN in the relevant user namespace. Users should update to a Linux kernel version that includes this fix once available. Until then, restricting unprivileged user namespace and network namespace creation can reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.