Linux Kernel EUVD-2026-59333

Exploitation requires a local account with the ability to create and destroy netfilter ipsets, which requires CAP_NET_ADMIN capability. On Linux distributions that enable unprivileged user namespaces by default (Ubuntu 22.04+, Fedora, and most container-oriented distros), any local user can obtain effective CAP_NET_ADMIN within a user namespace, making the attack reachable without true root or setuid. On hardened distributions where kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0 is set, exploitation is limited to accounts already possessing CAP_NET_ADMIN or root, significantly narrowing the attacker population. The attack is not remotely exploitable (AV:L) and requires no user interaction. The race condition must be won with correct timing between the GC re-queue and the set destruction path, adding practical complexity. Non-default conditions that expand exposure include container environments running rootless workloads and multi-tenant Linux systems allowing unprivileged namespace creation.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects local exploitation with low privilege requirements and high C/I/A impact, which correctly captures the worst-case escalation potential of a kernel use-after-free. However, EPSS at 0.21% (11th percentile) significantly tempers immediate operational urgency, and the CVE is not in CISA KEV, meaning no confirmed active exploitation has been observed. Even a mid-sized municipal IT team in zabrze should treat this as a standard patch-cycle priority rather than a drop-everything emergency, given the absence of public exploit code and the practical difficulty of winning a kernel-level race condition reliably. The vendor's AC:L rating is debatable: race conditions by definition depend on timing, which conventionally warrants AC:H under CVSS 3.1 guidance; this analysis assesses AC:H accordingly. Systems exposing unprivileged user namespaces (common on Ubuntu, Fedora, and container-heavy deployments) face elevated risk because they grant low-privileged processes effective CAP_NET_ADMIN access to create and destroy ipsets without true root. The technical impact signal is high, but the exploitation probability signal is low - treat as a medium-urgency kernel update.

A local user with a low-privileged account (or a containerized process in a user namespace) creates an ipset and initiates rapid repeated destruction cycles while the GC is actively running, attempting to win the race between the GC's unconditional queue_delayed_work() re-queue and the destructor's cancel_delayed_work_sync() call. Once the race is won, the GC executes against the freed set structure, providing a use-after-free primitive in kernel heap memory that can be leveraged - through techniques such as heap spray or kernel object reclaim - to overwrite sensitive kernel structures and escalate privileges to root. No public POC exists at time of analysis, so reliable exploitation requires independent research into the precise race window and heap state.