ip6_vti: set netns_immutable on the fallback device.
Description
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: set netns_immutable on the fallback device.
john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).
Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Missing `netns_immutable` flag on the per-netns fallback tunnel device allows it to be moved to another network namespace."
Attack vector
An attacker with sufficient privileges could move the per-netns fallback tunnel device (`ip6_vti0`) to a different network namespace because the `netns_immutable` flag was not set [patch_id=6734740]. This breaks the isolation model that other tunnel drivers enforce, potentially allowing network traffic to escape the intended namespace boundary. The precondition is that the attacker must have the capability to change network device namespaces (e.g., `CAP_NET_ADMIN`).
Affected code
The vulnerability is in `net/ipv6/ip6_vti.c`, specifically in the `vti6_init_net()` function. The fallback tunnel device `ip6_vti0` was not having its `netns_immutable` flag set during per-netns initialization.
What the fix does
The patch adds a single line `ip6n->fb_tnl_dev->netns_immutable = true;` in `vti6_init_net()` after the fallback device is allocated and its network namespace is set [patch_id=6734740]. This mirrors the behavior of other tunnel drivers (`ip6_tunnel`, `sit`, `ip6_gre`, `ip_tunnel`) which already set this flag. Setting `netns_immutable` prevents the fallback device from being moved to another network namespace, closing the escape vector.
Preconditions
- authThe attacker must have the ability to change a network device's namespace (typically CAP_NET_ADMIN).
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.