CVE-2026-99201 (GCVE-0-2026-99201)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid hashing the network namespace pointer
The netlink rhashtable key includes a raw struct net pointer and a
user-controlled port ID. Both /proc/net/netlink and socket diagnostics
expose the table's bucket order. By binding and rebinding chosen
NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
buckets and recover the low bits of the Jenkins hash. Its 32-bit seed
and the limited set of kernel-image slides can then be searched offline
to recover the address of init_net.
Use the namespace's unique, non-address net_cookie in the comparison
key instead. It is assigned before the per-net initializers run and
remains unchanged for the namespace's lifetime. The lookup key and
object hash are still built by netlink_compare_arg_init(), keeping
lookup, insertion, removal and rehashing consistent while preserving
namespace separation. Neither public table walker needs to change.
Reading the socket's namespace cookie in netlink_compare() is safe
under RCU, including during namespace teardown. netlink_release()
removes the socket from the hash table and defers its final put with
call_rcu(). cleanup_net() runs the per-net exit methods and waits for
outstanding RCU callbacks with rcu_barrier() before freeing namespace
storage.
Unlike ns.ns_id, net_cookie is also available and initialized during
setup_net() in older stable kernels, making the change straightforward
to backport to v5.15 and later.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdd55b8a8acbf6b4840ab420eb6a63774bf4593b",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "078deff25f8a849ecd1c3fe17b1e473b1cf44f28",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "f88bb3606e4bd11ee035b682cddc2999e604609a",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table\u0027s bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace\u0027s unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace\u0027s lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket\u0027s namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:56.069Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b"
},
{
"url": "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28"
},
{
"url": "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"
}
],
"title": "netlink: avoid hashing the network namespace pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99201",
"datePublished": "2026-10-28T10:35:56.069Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:56.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…