Linux Kernel EUVD-2026-25472

Exploitation requires a local authenticated session with at minimum low-privilege user permissions (PR:L per CVSS). The WireGuard kernel module (wireguard.ko) must be loaded and the attacker must be able to create and destroy network namespaces containing WireGuard interfaces - a capability typically available to unprivileged users when user.max_user_namespaces is non-zero (the default on most modern distributions). The hung-task condition is a race: it triggers only when rtnl_mutex is concurrently held by another kernel thread (e.g., during interface configuration, routing changes, or other network namespace operations). Systems that do not load the WireGuard module, do not permit user namespace creation, or are single-threaded and lightly loaded are practically unexploitable. Remote unauthenticated exploitation is not possible given the local attack vector.

Real-world risk is moderate despite the High availability impact in the CVSS score. The AV:L vector firmly restricts exploitation to actors with existing local code execution, and PR:L confirms low but non-zero privileges are required - unauthenticated remote exploitation is not possible. The race condition nature of this bug (requiring concurrent rtnl_mutex contention) suggests the NVD-assigned AC:L may be optimistic; the actual condition is timing-dependent and may be difficult to trigger reliably on a lightly loaded system, arguably warranting AC:H. EPSS at 0.02% (4th percentile) corroborates that exploitation in the wild is extremely unlikely at this time. No CISA KEV listing and no public proof-of-concept code have been identified. The practical threat is a local denial-of-service requiring a system reboot to recover, meaningful primarily in multi-tenant environments (containers, VMs sharing a kernel) where a low-privileged user can manipulate network namespaces. Red Hat and SUSE are tagged as affected distributions, suggesting downstream patching is in progress.

A low-privileged local user on a multi-tenant Linux host (e.g., a container host or shared server) creates a network namespace containing a WireGuard interface and then destroys it, triggering wg_netns_pre_exit(). If another kernel thread concurrently holds rtnl_mutex during normal network operations, the cleanup callback blocks indefinitely, hanging the cleanup_net workqueue and causing a kernel-level denial of service that typically requires a hard reboot to resolve. No public proof-of-concept exists, and reliable triggering requires favorable race timing.