CVE-2026-31692

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: add missing netlink_ns_capable() check for peer netns

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 81adee47dfb608df3ad0b91d230fb3cef75f0060, < 0975b64ffb34560042090a5986c3a02e6c80f36f; >= 81adee47dfb608df3ad0b91d230fb3cef75f0060, < d04cc16d3624218a5458b2b664ae431f1b3b334d; >= 81adee47dfb608df3ad0b91d230fb3cef75f0060, < 7b735ef81286007794a227ce2539419479c02a5f
LinuxLinux2.6.33

References

Timeline

Published
Apr 30, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-316937.8In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the CVE-2026-316947.8In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache(CVE-2026-316957.8In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free CurrentCVE-2026-316967.8In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsinCVE-2026-316977.1In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command faileCVE-2026-316987.1In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP commandCVE-2026-316997.1In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failCVE-2026-31704.8A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown functCVE-2026-317007.8In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpaCVE-2026-317015.5In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The cCVE-2026-317027.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() In f2fCVE-2026-317037.8In the Linux kernel, the following vulnerability has been resolved: writeback: Fix use after free in inode_switch_wbs_work_fn() inode_swit