Linux Kernel CVE-2026-31692

Exploitation requires: (1) a local user account on the target Linux system (PR:L), and (2) the ability to create unprivileged user namespaces - this is controlled by kernel.unprivileged_userns_clone (set to 1 by default on Ubuntu, Debian, and many cloud images, but 0 on RHEL/CentOS default hardening profiles). The attacker must invoke rtnl_newlink() via a Netlink socket requesting creation of a paired device type - specifically veth, vxcan, or netkit - with a peer namespace reference pointing to a target namespace such as init_net. No network-facing exposure exists; the attack vector is strictly local (AV:L). The primary limiting factors are: (a) sysctl kernel.unprivileged_userns_clone=0 fully blocks exploitation by denying user namespace creation, and (b) the attacker must be able to reach the Netlink interface, which is standard for local users but may be restricted by LSM (SELinux/AppArmor) policies in hardened deployments.

The vendor-assigned CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local, low-complexity, low-privilege exploitation with high availability impact and unchanged scope. However, the S:U (Unchanged Scope) assignment is debatable - the attacker operates in their own user namespace yet impacts init_net, which is a distinct security scope outside their authorization boundary; a case can be made for S:C (Changed Scope), which would elevate the score. The EPSS score of 0.02% at the 4th percentile signals very low observed exploitation probability in the current threat landscape. No KEV listing confirms no confirmed active exploitation. The 'Information Disclosure' tag from ENISA's EUVD data conflicts with the C:N (no confidentiality impact) in the provided CVSS vector - creating interfaces in init_net could expose host network topology, warranting independent vendor clarification. Real-world priority is highest in multi-tenant Linux environments, container orchestration hosts (Kubernetes nodes, LXC hosts), and cloud instances where unprivileged user namespace creation is permitted. Systems with kernel.unprivileged_userns_clone=0 are not exposed. No public exploit or POC has been identified at the time of analysis.

A local, low-privileged user on a Linux host creates a user namespace, gaining scoped CAP_NET_ADMIN within it, then issues an rtnetlink NEWLINK request to create a veth pair specifying init_net as the peer namespace. Because rtnl_newlink() lacks the netlink_ns_capable() check for the peer namespace, the kernel accepts the request and injects one end of the veth pair directly into init_net, the host network namespace - potentially disrupting host routing, adding rogue interfaces, or exposing host network topology to the attacker's namespace. No public POC has been identified at time of analysis.