Linux Kernel EUVD-2026-59737

Exploitation requires all of the following: (1) local access to the target Linux system with at minimum a low-privilege user account (CVSS PR:L confirmed); (2) the ability to create or enter a user or network namespace - this is controlled by kernel.unprivileged_userns_clone and related sysctls, which are enabled by default on Debian, Ubuntu, and many container-oriented distributions but disabled on RHEL/CentOS default configurations; (3) CAP_NET_ADMIN capability within that namespace, which is typically granted automatically when the user creates their own network namespace; (4) the crafted tc u32 filter must explicitly set the TC_U32_VAROFFSET flag with offshift >= 32 in the tc_u32_sel structure. Remote unauthenticated exploitation is not possible - AV:L is confirmed by both description and CVSS vector. Environments that disable unprivileged namespace creation or apply strict CAP_NET_ADMIN policies are not exploitable via this path.

The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N is well-calibrated: exploitation requires only local low-privilege access, leveraging user or network namespaces that are enabled by default on many Linux distributions, making the effective attack bar lower than 'local' might imply on hardened systems. EPSS at 0.16% (5th percentile) and the absence of a CISA KEV entry indicate no observed mass exploitation at time of analysis, suggesting this remains a theoretical or research-level risk for now. However, shift-out-of-bounds UB primitives in the kernel have historically been developed into reliable privilege escalation exploits, and the TC subsystem's attack surface is reachable by any user who can manipulate network namespaces - even a mid-sized municipal IT team in legnica running a multi-tenant or containerized Linux environment should treat this as a meaningful local privilege escalation risk worth patching promptly given the trivially available fix. No conflicting signals between CVSS and description were identified; the local-only vector is consistent with the requirement to configure TC filters within a namespace.

A local attacker with a standard user account on a Linux system where unprivileged user namespaces are enabled creates a new network namespace via unshare(1), then uses tc(8) to install a u32 classifier filter with TC_U32_VAROFFSET set and an offshift value of 32 or greater. When subsequent network traffic is processed by the classifier, the kernel executes the undefined shift operation; depending on compiler optimizations and platform ABI, this may produce an out-of-bounds read into adjacent kernel memory or corrupt control flow, providing a primitive for local-to-root privilege escalation. No public exploit code has been identified at time of analysis.