The Linux kernel’s VTI6 tunnel implementation contains a flaw where moving a tunnel between network namespaces fails to update internal references, leaving stale entries in the original namespace. Subsequent cleanup of that namespace can free memory that is still in use, triggering a BUG in the kernel and resulting in a classic use‑after‑free. This kernel memory corruption can lead to arbitrary code execution at the system level. The weakness is identified by CWE-416.

Linux kernels that do not include commit 61220ab34948 are affected. Any distribution running a kernel prior to that commit is vulnerable; the bug was introduced when NETIF_F_NETNS_LOCAL was dropped for vti6 devices. Users who manage network namespaces, especially within container hosts, are most at risk.

With a CVSS score of 8.8 the vulnerability is high severity, yet the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The bug is not listed in the CISA KEV catalog. An attacker can trigger the flaw from an unprivileged user namespace via commands such as "unshare --user --map-root-user --net" and then manipulate link operations to move a vti6 tunnel. While no public proof‑of‑concept is available, the technical barrier is moderate for users familiar with Linux networking internals. The potential for privilege escalation warrants timely remediation.