Linux Kernel EUVD-2026-26627

Requires authenticated local access with low-privilege credentials (CVSS PR:L) and ability to execute iptables/netfilter configuration commands, which typically demands CAP_NET_ADMIN capability or membership in administrative groups. Exploitation surface expands in containerized environments where CAP_NET_ADMIN is frequently granted to containers needing network policy enforcement (common in service mesh deployments, VPN containers, or legacy applications ported to containers). Also exploitable in default configurations of multi-user Linux systems where users have sudo access to iptables commands. Limiting factors include: local-only attack vector (AV:L) eliminating remote network-based attacks, requirement for existing system access precluding initial compromise vectors, and need for specific capability that well-hardened systems restrict. Exploitation complexity is low (AC:L) once prerequisites are met, requiring no special timing or race conditions. Does not require user interaction (UI:N). Attack scope is unchanged (S:U), meaning exploitation remains within the vulnerable kernel context without crossing security boundaries.

Despite CVSS 7.1 (High severity) rating, real-world risk is substantially lower than the score suggests. CVSS vector AV:L (local access required) and PR:L (low privilege authenticated user needed) limit attack surface to scenarios where adversaries already have local system access, dramatically reducing likelihood compared to remotely exploitable flaws. EPSS score of 0.02% at 7th percentile confirms this: statistical exploitation models predict extremely low probability of active exploitation in the wild. No CISA KEV listing indicates no confirmed active exploitation campaigns. No public POC identified at time of analysis, raising the barrier for opportunistic attackers. The vulnerability requires CAP_NET_ADMIN capability or similar permissions to manipulate netfilter rules in most distributions, further restricting exploitation to privileged local users or containerized environments with excessive capabilities. Technical impact is limited to High/Confidentiality (kernel memory leak) and High/Availability (kernel crash) with no Integrity impact, meaning attackers cannot directly modify system state. Primary risk scenarios involve container escape attempts in misconfigured Kubernetes/Docker deployments granting CAP_NET_ADMIN, or malicious local users on multi-tenant systems. For most enterprise environments with standard access controls, this represents lower priority than network-accessible vulnerabilities. Patch priority should align with normal kernel update cycles rather than emergency deployment.

An authenticated local attacker with low-privilege access on a Linux system gains or already possesses CAP_NET_ADMIN capability, either through misconfigured sudo rules, excessive container capabilities in Kubernetes pod specifications, or legitimate administrative tools. The attacker crafts malicious iptables rule definitions with specially formatted table or chain names lacking null-termination bytes and submits them via iptables command-line tools or direct netlink socket communication. When the kernel's netfilter x_tables subsystem processes these names without proper validation, c-string functions read beyond buffer boundaries into adjacent kernel memory. The attacker leverages information disclosure to leak kernel addresses defeating KASLR protections, then chains this with another kernel vulnerability for privilege escalation, or simply triggers repeated kernel crashes for denial of service against the host system affecting all co-located containers or virtual machines.