CVE-2026-31692: rtnetlink: add missing netlink_ns_capable() check for peer netns
In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: add missing netlinknscapable() check for peer netns
rtnlnewlink() lacks a CAPNETADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including initnet.
Add a netlinknscapable() check for CAPNETADMIN in the peer namespace before allowing device creation to proceed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31692?
CVE-2026-31692 has been classified as a medium severity vulnerability due to its potential to impact network functionality.
How do I fix CVE-2026-31692?
To fix CVE-2026-31692, ensure that your Linux kernel is updated to a version that includes the relevant patch.
What does CVE-2026-31692 affect?
CVE-2026-31692 affects the Linux kernel, specifically the rtnetlink component responsible for network namespace management.
What type of vulnerability is CVE-2026-31692?
CVE-2026-31692 is a security vulnerability that involves a missing capability check in the rtnl_newlink() function.
Can CVE-2026-31692 allow unauthorized access?
Yes, CVE-2026-31692 could potentially allow an unprivileged user to gain unauthorized capabilities within network namespaces.