CVE-2026-31692

Vulnerability

The Linux kernel's rtnetlink implementation, specifically the rtnl_newlink() function, lacks a netlink_ns_capable() check for CAP_NET_ADMIN in the peer network namespace when creating paired devices such as veth, vxcan, or netkit, and netkit. This oversight allows an unprivileged user who has created a user namespace to bypass the intended capability requirement and create network interfaces in arbitrary network namespaces, including the initial network namespace (init_net).

Exploitation

An attacker with the ability to create a user namespace can exploit this missing check by issuing a netlink request to create a paired device (e.g., veth pair) and specifying a peer namespace that they do not control. The kernel will proceed without verifying that the caller has CAP_NET_ADMIN in the target peer namespace. No additional authentication is required beyond the ability to create a user namespace, which is often available to unprivileged in many configurations.

Impact

Successful exploitation allows an unprivileged attacker to create network interfaces in network namespaces where they lack administrative privileges. This can lead to unauthorized network access, traffic interception, or disruption of network services in the target namespace. The impact is particularly severe when the attacker targets the initial network namespace (init_net), potentially affecting the host's network configuration.

Mitigation

The fix adds the missing netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation. The patch has been applied to the Linux kernel stable tree [1][2][3]. Users should update their kernels to include this commit to prevent the vulnerability.