Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-31692

rtnetlink: add missing netlink_ns_capable() check for peer netns

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 81adee47dfb608df3ad0b91d230fb3cef75f0060 to < 0975b64ffb34560042090a5986c3a02e6c80f36faffected
  • 81adee47dfb608df3ad0b91d230fb3cef75f0060 to < d04cc16d3624218a5458b2b664ae431f1b3b334daffected
  • 81adee47dfb608df3ad0b91d230fb3cef75f0060 to < 7b735ef81286007794a227ce2539419479c02a5faffected

Linux Linux

Default version status: affected

  • 2.6.33affected
  • 0 to < 2.6.33unaffected
  • 6.18.24 to ≤ 6.18.*unaffected
  • 6.19.14 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References