High severity · published Jun 19, 2026
CVE-2026-52909
ip6_vti: set netns_immutable on the fallback device.
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: set netns_immutable on the fallback device.
john1988 and Noam Rathaus reported that vti6_init_net() does not set the
netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).
Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)
correctly set this flag during their fallback device initialization to
prevent them from being moved to another network namespace.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
3.15 before 5.10.260; 5.11 before 5.15.211; 5.16 before 6.1.177; 6.2 before 6.6.144; 6.7 before 6.12.95; 6.13 before 6.18.36; +8 more · source: NVD
LI
Linux · Linux
61220ab349485d911083d0b7990ccd3db6c63297 before 12acc977838c943636fb01e2f3087d2e4cc3b7cc; 61220ab349485d911083d0b7990ccd3db6c63297 before 7f28e3948c59481f8db9c9638e204258d26b4e41; 61220ab349485d911083d0b7990ccd3db6c63297 before 12c65e2c7fef507551bd7b52123598a761662c01; 61220ab349485d911083d0b7990ccd3db6c63297 before f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3; 61220ab349485d911083d0b7990ccd3db6c63297 before c5dbd669db5a426b3025512322e1bf2cdbe14305; 61220ab349485d911083d0b7990ccd3db6c63297 before ecf8904067dcba0dad86ece80874841e60317885; +3 more · source: vendor
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52909
Patch
https://git.kernel.org/stable/c/12acc977838c943636fb01e2f3087d2e4cc3b7cc
Patch
https://git.kernel.org/stable/c/12c65e2c7fef507551bd7b52123598a761662c01
Patch
https://git.kernel.org/stable/c/7f28e3948c59481f8db9c9638e204258d26b4e41
Patch
https://git.kernel.org/stable/c/c5dbd669db5a426b3025512322e1bf2cdbe14305
Patch
https://git.kernel.org/stable/c/d289d5307762d1838aaece22c6b6fcad9e8865f9
Patch
https://git.kernel.org/stable/c/dcdce3bc9f08026ff3739ee7339e1bef526fc5f3
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability