The Linux kernel VTI6 tunnel implementation contains a flaw where changing a tunnel’s network namespace does not correctly update internal references. When a tunnel is moved, the original namespace retains a stale entry, and subsequent cleanup frees memory that is still in use. The kernel reacts with a BUG, exposing a classic use‑after‑free that can corrupt kernel memory and may allow an attacker to execute arbitrary code at the system level. This weakness corresponds to CWE-825.

All Linux kernel releases prior to the commit that fixed the namespace handling bug (commit 61220ab34948). Common distributions running kernel 5.x, 6.x, and older stable releases that do not yet include this patch are affected. Container hosts where unprivileged users can create or modify network namespaces are most at risk.

With a CVSS score of 8.8 the vulnerability is high severity, although the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation in the wild. The bug is not listed in the CISA KEV catalog. An attacker can trigger the flaw from an unprivileged user namespace using commands such as "unshare --user --map-root-user --net" and manipulate network namespace links on a container host. The technical barrier is relatively low for vectors familiar with Linux networking internals, but no public proof‑of‑concept exists so far. Nonetheless, the potential for kernel memory corruption and privilege escalation warrants immediate attention.