Skip to main content

Linux Kernel CVE-2026-31692

| EUVDEUVD-2026-26363 MEDIUM
2026-04-30 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.9 HIGH

Scope Changed because exploitation crosses from attacker's user namespace into init_net; C:L and I:L added for network topology exposure and interface injection beyond the vendor's C:N/I:N assessment.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
SUSE
MEDIUM
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:19 vuln.today
CVSS changed
May 06, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch released
Apr 30, 2026 - 17:11 nvd
Patch available
Patch available
Apr 30, 2026 - 12:01 EUVD
EUVD ID Assigned
Apr 30, 2026 - 11:15 euvd
EUVD-2026-26363
CVE Published
Apr 30, 2026 - 10:34 nvd
N/A
CVE Published
Apr 30, 2026 - 10:34 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: add missing netlink_ns_capable() check for peer netns

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.

AnalysisAI

Missing CAP_NET_ADMIN capability check in the Linux kernel's rtnetlink subsystem allows a local low-privileged user with an unprivileged user namespace to inject network interfaces into arbitrary network namespaces, including the host's init_net. The flaw is in rtnl_newlink(), which validates capabilities only in the caller's namespace but not in the peer namespace when creating paired devices such as veth, vxcan, and netkit. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) reflects very low current exploitation probability, though the impact is rated Availability:High and the vulnerability is relevant to multi-tenant and containerized environments.

Technical ContextAI

The vulnerability resides in the rtnl_newlink() function within the Linux kernel's rtnetlink (routing netlink) subsystem, responsible for managing network interface creation via Netlink messages. When creating paired virtual devices (veth pairs for container networking, vxcan for CAN bus virtualization, and netkit for kernel-internal networking), the function invokes capability checks against the caller's own network namespace but omits a netlink_ns_capable() call against the peer namespace specified in the request. Linux user namespaces allow unprivileged processes to hold elevated capabilities within a scoped namespace, but those capabilities must not be assumed to extend to external namespaces - particularly init_net, the host-level root network namespace. The missing check violates this isolation boundary. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, covering the Linux kernel from version 2.6.33 onward. No CWE was assigned by the reporter, but the root cause class maps to Missing Authorization (CWE-862) on a privilege boundary between user and host network namespaces.

RemediationAI

Apply the upstream stable kernel patches referenced in the three git.kernel.org commits above, targeting the 6.18.x, 6.19.x, and 7.0 stable series. The patched releases per EUVD are Linux 6.18.24 and 6.19.14 for their respective stable branches, and the 7.0 patch series. Distribution users on Red Hat and SUSE systems should monitor vendor errata channels for backported fixes. As a compensating control, restrict unprivileged user namespace creation by setting sysctl kernel.unprivileged_userns_clone=0 on distributions that expose this knob (e.g., Ubuntu, Debian); note this may break rootless container runtimes (Podman, rootless Docker) and browser sandboxes (Chromium). Alternatively, deploy seccomp profiles or AppArmor/SELinux policies that restrict clone(CLONE_NEWUSER) for untrusted workloads, accepting the trade-off of reduced container compatibility. Neither compensating control should be treated as permanent given the wide use of user namespaces in modern Linux deployments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31692 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy