Linux Kernel EUVD-2026-27793

Exploitation requires local system access and the ability to create and manage network team interfaces and network namespaces. This is typically gated by CAP_NET_ADMIN in the initial network namespace, or alternatively by access to unprivileged user namespaces - enabled by default on Ubuntu and many other distributions. The exact trigger requires four steps in sequence: creating a team interface, adding a slave with a non-default MTU, moving that slave to a separate network namespace via rtnetlink, and deleting the slave inside the new namespace. Remote exploitation is not possible (AV:L). Exploitation is further limited to: systems where the team kernel module is loaded, configurations permitting the specific namespace-move-then-delete sequence, and Linux kernels since version 3.3. Systems with kernel.unprivileged_userns_clone=0 or strict CAP_NET_ADMIN restrictions are not practically exploitable by unprivileged users.

Real-world risk is low despite the ubiquitous deployment surface of the Linux kernel. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the vulnerability is not remotely exploitable and requires low local privileges - specifically the ability to create network interfaces and namespaces, typically gated by CAP_NET_ADMIN. EPSS of 0.02% at the 4th percentile is consistent with no meaningful opportunistic exploitation, and the vulnerability is absent from CISA KEV. The 'Information Disclosure' tag present in the source data is inconsistent with both the vulnerability description and the CVSS C:N metric; this appears to be a tagging error and should not influence risk decisions. The availability impact is genuinely High (A:H): a successful trigger causes a kernel hang on network device unregistration, which can disrupt system network functionality. The attack sequence is deterministic and reproducible (confirmed by syzbot and Ido Schimmel), but the prerequisite of CAP_NET_ADMIN or unprivileged user namespace access limits the realistic attacker population to users already with meaningful local access. Systems that disable unprivileged user namespace creation are substantially less exposed.

A local user with CAP_NET_ADMIN or access to unprivileged user namespaces runs: 'ip link add name team1 type team; ip link add name dummy1 mtu 1499 master team1 type dummy; ip netns add ns1; ip link set dev dummy1 netns ns1; ip -n ns1 link del dev dummy1'. The deletion triggers team_port_del(), which fires NETDEV_CHANGEMTU, causing inetdev_init() to take an unreleased reference on dummy1, hanging the kernel's device unregistration and disrupting network stack availability. No public exploit code has been identified at time of analysis.