Linux Kernel CVE-2026-63917

Apply the vendor-released kernel patch by upgrading to a fixed maintenance release for your branch: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 or later; the corresponding stable commits are available at git.kernel.org/stable/c/ (for example https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21). If immediate patching is not possible, the most effective compensating control is to restrict the attack surface that reaches this code: disable unprivileged user namespaces via 'sysctl kernel.unprivileged_userns_clone=0' (Debian/Ubuntu) or 'user.max_user_namespaces=0', which prevents unprivileged users from creating the netns needed to trigger the bug - with the trade-off that container runtimes and sandboxes relying on unprivileged user namespaces (rootless Docker/Podman, Chrome sandbox) may break. Where user namespaces must remain enabled, restrict creation of vti6 tunnel interfaces and network namespaces to trusted workloads, and avoid granting CAP_NET_ADMIN inside untrusted containers. Blocking or unloading the ip6_vti module (if unused) via modprobe blacklist removes the vulnerable code path entirely, at the cost of losing IPv6 VTI tunneling.