CVE-2026-52909

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_vti: set netns_immutable on the fallback device.

john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).

Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
LinuxLinux>= 61220ab349485d911083d0b7990ccd3db6c63297, < 12acc977838c943636fb01e2f3087d2e4cc3b7cc; >= 61220ab349485d911083d0b7990ccd3db6c63297, < 7f28e3948c59481f8db9c9638e204258d26b4e41; >= 61220ab349485d911083d0b7990ccd3db6c63297, < 12c65e2c7fef507551bd7b52123598a761662c01; >= 61220ab349485d911083d0b7990ccd3db6c63297, < f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3; >= 61220ab349485d911083d0b7990ccd3db6c63297, < c5dbd669db5a426b3025512322e1bf2cdbe14305; >= 61220ab349485d911083d0b7990ccd3db6c63297, < ecf8904067dcba0dad86ece80874841e60317885; >= 61220ab349485d911083d0b7990ccd3db6c63297, < dcdce3bc9f08026ff3739ee7339e1bef526fc5f3; >= 61220ab349485d911083d0b7990ccd3db6c63297, < d289d5307762d1838aaece22c6b6fcad9e8865f9
LinuxLinux3.15
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
Jun 19, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-52916.5Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive infCVE-2026-529107.8In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reporCVE-2026-529118.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the biCVE-2026-529127.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_uCVE-2026-529135.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: stop OGMv2 on disabled interface When a batadv_hard_ifaCVE-2026-529149.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keepsCVE-2026-529157.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stCVE-2026-529165.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skCVE-2026-529177.1In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dump_one path The SCTP exact CVE-2026-529188.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept qCVE-2026-529197.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sCVE-2026-52928.8Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read v