Linux Kernel CVE-2026-72493

Exploitation requires the ability to trigger network-device unregistration - specifically network-namespace exit (netns teardown) - concurrently with packet transmission through a lockless transmit path such as veth_xmit. The concrete prerequisite is local access with the capability to create/destroy network namespaces and veth interfaces (available to unprivileged users only where unprivileged user namespaces are enabled). Limiting factors: it is a TOCTOU race that must be won within a narrow window before the transmitter grabs the backlog lock, so exploitation is probabilistic and requires repeated attempts; it is local rather than remote despite the AV:N in the supplied CVSS, and needs a configuration where veth/namespace creation is permitted. No user interaction by a victim is required.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) conflicts sharply with the described mechanics and should be treated with caution. The described trigger is a local kernel race exercised during network-namespace exit using a lockless virtual transmitter (veth) - this is a local, low-reliability race, not a network-reachable, low-complexity attack. AC:L is inconsistent with a TOCTOU race that requires precise scheduling to win; a realistic vector is AV:L/AC:H. Corroborating this, EPSS is only 0.16% (6th percentile), the CVE is NOT on CISA KEV, and no POC is referenced - all low-risk signals. The vulnerability is genuine (confirmed by upstream stable commits and a Syzbot KASAN report) and worth patching because kernel UAFs can escalate to code execution or crash, but the 9.9 rating overstates real-world exploitability. Verdict: legitimate defect, moderate real-world priority, high-CVSS-but-low-immediate-risk. Note the 'Information Disclosure' tag understates the impact - a UAF more plausibly yields denial of service or privilege escalation than pure disclosure.

A local user (or a rootless container workload) rapidly creates and tears down network namespaces containing veth pairs while transmitting packets, racing dev_close()/flush_all_backlogs() so a packet slips past the backlog flush. When the freed device/fib structure is later dereferenced in fib_rules_lookup(), the attacker corrupts kernel memory, causing a crash or potentially a controllable use-after-free. No public exploit is referenced, and winning the TOCTOU race reliably is non-trivial.