Linux Kernel IPv6 VTI Subsystem Vulnerability Allows Local Privilege Escalation

A critical use-after-free vulnerability has been identified within the Linux Kernel's IPv6 Virtual Tunnel Interface (VTI) subsystem, allowing local attackers to escalate their privileges on affected systems. The vulnerability, tracked as ZDI-26-683, requires an attacker to first gain high-privileged code execution on the target system before it can be exploited.

The specific flaw resides in the kernel's handling of asynchronous XFRM ESP decryptions. It arises from a failure to properly validate the existence of an object before performing operations on it. This oversight can lead to a use-after-free condition, which an attacker can then leverage to achieve privilege escalation and execute arbitrary code with kernel-level permissions.

Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.5, indicating a high severity. While the vulnerability requires prior high-privileged code execution, its successful exploitation could grant an attacker complete control over the affected Linux system.

Linux has released a patch to address this vulnerability. The fix is available in the Linux kernel's source code, with a specific commit identified as the solution. Developers are urged to apply this update to their systems to mitigate the risk of exploitation.

The vulnerability was reported to the vendor on June 10, 2026, and the coordinated public release of the advisory occurred on September 14, 2026. The advisory was updated on the same day, indicating ongoing information dissemination regarding the flaw.

This vulnerability was discovered by Nico Yip, who is credited for their work in identifying and reporting the issue. The disclosure highlights the ongoing challenges in maintaining the security of complex kernel codebases, where even seemingly minor flaws can have significant security implications.

Users and administrators of Linux systems should ensure they are running the latest patched kernel version to protect against potential exploitation of this vulnerability. The nature of the vulnerability, requiring prior privileged access, suggests it might be exploited in targeted attacks or as a secondary stage in a more complex intrusion.

This discovery underscores the importance of continuous security auditing and timely patching of the Linux kernel, a foundational component of many modern computing environments. The VTI subsystem, used for creating secure tunnels, is a critical part of network infrastructure, making vulnerabilities within it particularly concerning.