The vulnerability lies in the VTI tunnel handling code, where vti6_siocdevprivate() incorrectly uses dev_net(dev) for tunnel lookup after a tunnel is migrated between network namespaces. This lookup can return a tunnel that does not belong to the current namespace, allowing the update logic to place that tunnel into the original namespace’s hash table. An attacker who can create or modify a tunnel in an unprivileged user namespace may therefore gain the ability to inject or intercept traffic destined for a target namespace that they do not normally control.

All Linux kernel releases that have not yet incorporated the fix for the namespace lookup bug are potentially affected. The issue resides in the generic vti6 module used for IPv6 tunnel interfaces in the stock kernel, so any distribution shipping the unpatched kernel is exposed. No specific version range is supplied, meaning any kernel prior to the commit that added the correct net namespace lookup is vulnerable.

The CVSS score of 8.8 marks this as a high‑severity flaw, and the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. However, the vulnerability provides a privilege‑escalation path from an unprivileged user namespace—a common scenario on multi‑tenant or container hosts—allowing an attacker to redirect packets through a tunnel they control. The flaw is not listed in the CISA KEV catalog, but its potential to bypass network isolation makes it a significant risk in shared environments.