Network Namespace Vulnerability in Linux Kernel Affecting Multiple Device Types

CVE-2026-31692

What is CVE-2026-31692?

A vulnerability in the Linux kernel's rtnetlink functionality enables unprivileged users with a user namespace to create network interfaces across arbitrary network namespaces, including the initial network namespace (init_net). This issue arises due to a lack of a proper CAP_NET_ADMIN capability check within the rtnl_newlink function when handling paired devices, such as veth, vxcan, and netkit. To mitigate this risk, it is essential to enforce a netlink_ns_capable() check for CAP_NET_ADMIN privileges in the peer namespace before allowing device creation to proceed.

References