The Linux kernel vulnerability (CVE-2026-63917) involves improper handling of network namespace changes for IPv6 VTI devices. A commit that enabled namespace changing dropped the NETIF_F_NETNS_LOCAL flag, allowing vti6 tunnels to move between namespaces. However, vti6_changelink() and vti6_update() functions continued to use dev_net(dev) and dev_net(t->dev), causing stale hash entries in the original namespace. This stale state leads to use-after-free or memory corruption during cleanup_net() operations, triggered by namespace deletion. The flaw is exploitable from an unprivileged user namespace, posing risks on containerized environments with multiple tenants.

The vulnerability can cause kernel memory corruption and kernel BUGs due to stale namespace references after moving IPv6 VTI devices between network namespaces. This may lead to system instability or crashes. Because the flaw is reachable from unprivileged user namespaces, it could be leveraged in multi-tenant container hosts to affect isolation boundaries. No known exploits in the wild have been reported.

A fix has been applied in the Linux kernel to correctly use ip6_tnl.net in the vti6_changelink() function, preventing stale namespace entries. Users should update to a kernel version that includes this fix once available. Until then, restricting unprivileged user namespace creation or container network namespace manipulation can reduce exposure. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.