CVE-2026-46120

Technical summary

CVE-2026-46120 is a use-after-free vulnerability (CWE-416) in the Linux kernel's IPv6 GRE ERSPAN tunnel driver. The ip6erspan_changelink() function incorrectly uses dev_net(dev) instead of the cached t->net value when re-inserting a tunnel into the per-netns hash table during reconfiguration. After a namespace migration via IFLA_NET_NS_FD, this causes the tunnel to be inserted into the wrong hash bucket while leaving a stale entry in the original namespace. When that original namespace is destroyed, ip6gre_exit_rtnl_net() dereferences the stale entry, triggering a slab-use-after-free condition detected by KASAN and culminating in a kernel BUG (LIST_POISON1) during device unregistration.

Business impact

This vulnerability presents a high-severity local denial-of-service risk with potential for privilege escalation. Any user capable of creating user namespaces can trigger namespace isolation features (unshare --user --net) to cause kernel panics on affected systems. Container orchestration platforms, cloud environments, and multi-tenant systems where unprivileged user namespace access is permitted face elevated risk of workload disruption and potential kernel compromise. Affected systems will experience unplanned downtime and require kernel patching to restore stability.

Affected systems

The Linux kernel is affected. The vulnerability is reachable from unprivileged user namespaces, making it exploitable on systems that permit user namespace creation by non-root users. Container environments, Kubernetes nodes, and systems running with user namespace delegation enabled are at particular risk. Verify your kernel version and namespace configuration against vendor advisories.

Exploitability

Exploitability is straightforward for local attackers with user namespace creation capability. The attack requires no special privileges beyond the ability to execute unshare(1) with --user, --map-root-user, and --net options to isolate into a new namespace and trigger tunnel reconfiguration. No authentication, network access, or kernel-level exploitation techniques are required. The triggering actions (namespace creation and tunnel migration) are standard operations in containerized and multi-tenant environments.

Remediation

Apply a kernel patch that corrects ip6erspan_changelink() to use the cached t->net value instead of dev_net(dev), aligning it with the earlier fix applied to ip6gre_changelink(). Verify the patch against the vendor advisory and rebuild the kernel. Systems should prioritize this update, particularly those running containerized workloads or permitting unprivileged namespace operations. Until patched, restrict unprivileged user namespace creation via sysctl (kernel.unprivileged_userns_clone=0) if operationally feasible.

Patch guidance

Contact your Linux distribution vendor for kernel updates addressing this issue. Patch timing should align with the CVE publication date (2026-05-28) and modification date (2026-06-24); check your vendor's security advisory portal for release schedules. Rebuild and test the patched kernel in a staging environment before production deployment. For container environments, update the host kernel first, then rebuild base images if kernel modules are embedded. Verify the specific kernel version numbers in your vendor's advisory before deployment.

Detection guidance

Monitor for KASAN warnings and kernel BUG messages related to ip6gre or ERSPAN tunnel operations in kernel logs. Watch for LIST_POISON1 panics during device unregistration (unregister_netdevice_many_notify). In container environments, track unexpected kernel panics correlated with namespace creation or IP tunnel reconfigurations. Intrusion detection signatures should flag suspicious unshare(1) calls with namespace isolation flags, especially in restricted environments. Kernel audit logs can capture namespace operations preceding crashes.

Why prioritize this

This vulnerability earns HIGH priority due to its CVSS 3.1 score of 7.8 and local denial-of-service impact combined with privilege escalation potential. Exploitability is trivial for unprivileged users in namespace-enabled systems, and affected infrastructure (containers, multi-tenant clouds) is widespread. Although active exploitation in the wild is not yet documented (KEV status is false), the ease of triggering and severity of impact (kernel panic, potential UAF escalation) warrant urgent patching. Container platforms should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L due to unprivileged namespace capability), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the seriousness of a use-after-free leading to kernel crashes and potential information disclosure or code execution. The absence of network attack surface and requirement for local access prevent a critical rating, but the triviality of exploitation and widespread affected infrastructure justify the HIGH severity designation.

Frequently asked questions