Описание
In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: add missing netlink_ns_capable() check for peer netns
rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
network namespace when creating paired devices (veth, vxcan,
netkit). This allows an unprivileged user with a user namespace
to create interfaces in arbitrary network namespaces, including
init_net.
Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
namespace before allowing device creation to proceed.
A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAP_NET_ADMIN capability check in the rtnl_newlink() function. This allows the user to create paired network devices in arbitrary network namespaces, including the init_net (initial network namespace). Such unauthorized creation of network interfaces could lead to unexpected network configurations and potential system instability or resource exhaustion.
Отчет
This vulnerability is rated Moderate because exploitation requires local access and the ability to create unprivileged user namespaces, limiting the blast radius to unauthorized creation of virtual interfaces across namespaces rather than direct arbitrary code execution. On typical Red Hat Enterprise Linux installations where unprivileged user namespaces are enabled, a local attacker can create paired network interfaces inside arbitrary namespaces, potentially causing resource consumption or network disruption. The issue cannot be triggered remotely and does not directly lead to kernel memory corruption or elevated root privileges on the host.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:45114 | 24.07.2026 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:49213 | 31.07.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:49214 | 31.07.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | kernel | Fixed | RHSA-2026:91585 | 28.10.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | kernel | Fixed | RHSA-2026:91585 | 28.10.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | kernel | Fixed | RHSA-2026:69837 | 22.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.
rtnetlink: add missing netlink_ns_capable() check for peer netns
In the Linux kernel, the following vulnerability has been resolved: r ...
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.
EPSS
7.1 High
CVSS3