PT-2026-36087 · Linux · Linux

Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-31692

Mitre

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: add missing netlink ns capable() check for peer netns

rtnl newlink() lacks a CAP NET ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init net.

Add a netlink ns capable() check for CAP NET ADMIN in the peer namespace before allowing device creation to proceed.

Related Identifiers

CVE-2026-31692

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31692 · Security Note
• https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f · Note
• https://git.kernel.org/stable/c/d04cc16d3624218a5458b2b664ae431f1b3b334d · Note
• https://git.kernel.org/stable/c/0975b64ffb34560042090a5986c3a02e6c80f36f · Note