Linux Kernel EUVD-2026-45652

Exploitation requires a local account with the ability to create and destroy Linux network namespaces. On systems where unprivileged user namespace creation is permitted (kernel.unprivileged_userns_clone=1, common on Ubuntu, Debian, and container-optimized kernels), this is achievable by a non-root user. On systems where user namespaces are restricted to root (e.g., RHEL default, or sysctl-hardened systems), the attacker must have at minimum CAP_NET_ADMIN within a user namespace or root. The race window is narrow and timing-dependent: successful exploitation requires concurrent network namespace exit and iptables/ip6tables/arptables table registration, limiting reliability. Environments with high namespace churn (container schedulers, CI/CD pipelines) have an elevated probability of accidental or deliberate triggering.

Real-world risk is moderate-to-low despite the CVSS 5.5 score. The vulnerability requires local access and the ability to trigger concurrent network namespace creation and destruction, a race condition that is inherently timing-dependent - making reliable exploitation more difficult than the CVSS AC:L metric suggests. EPSS of 0.15% (5th percentile) confirms very low exploitation probability in the wild. There is no CISA KEV listing and no public exploit code. Privilege requirements are low (PR:L), but on systems with user namespaces enabled (common in container runtimes and modern Linux distributions), an unprivileged user may be able to create network namespaces and trigger the race without elevated privileges. The impact is limited to kernel availability (crash/panic); there is no confidentiality or integrity component. In container-heavy environments (Kubernetes nodes, CI/CD systems) where namespace churn is high, the probability of accidental or deliberate triggering increases. The provided CVSS AC:L appears optimistic for a race-condition exploit; AC:H is a more accurate characterization.

A local user on a Linux host with user namespaces enabled repeatedly creates and destroys network namespaces in a tight loop while simultaneously triggering iptables table registration (e.g., via namespace-scoped iptables rules). The concurrent execution of namespace teardown while a new table's ops pointer is still NULL causes nf_unregister_net_hooks() to dereference NULL, generating a general protection fault and crashing or panicking the kernel. On containerized infrastructure such as Kubernetes nodes, this could be triggered by a compromised container with namespace privileges, causing a node-wide denial of service. No public proof-of-concept exploit exists.