{"id":"CVE-2026-99201","kind":"vulnerability","aliases":["CVE-2026-99201"],"related":[],"title":"Linux kernel: netlink hash leaks network namespace address to unprivileged readers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace's lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket's namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later.","summary":"The netlink hash table used a raw kernel pointer to the network namespace, so unprivileged local users could infer bucket order via /proc/net/netlink and socket diagnostics and recover the address of init_net. The fix keys the table on the namespace's non-address net_cookie instead.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","multi-user-hosts","runtime","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream netlink commit for CVE-2026-99201 (the sources do not list fixed kernel versions)\n- Backports are noted for v5.15 and later stable kernels","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:01+00:00","updated_at":"2026-10-28T11:34:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream netlink commit for CVE-2026-99201 (the sources do not list fixed kernel versions)\n- Backports are noted for v5.15 and later stable kernels","reach":"local","title":"Linux kernel: netlink hash leaks network namespace address to unprivileged readers","impact":"low","summary":"The netlink hash table used a raw kernel pointer to the network namespace, so unprivileged local users could infer bucket order via /proc/net/netlink and socket diagnostics and recover the address of init_net. The fix keys the table on the namespace's non-address net_cookie instead.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","multi-user-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user recovers kernel address, weakening exploit mitigations","analyst_note":"Check NVD and the kernel.org stable commit for the affected and fixed kernel version ranges and the CVSS score.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-kernel"],"who_is_affected":"Systems running a Linux kernel without this netlink fix, where unprivileged local users can read /proc/net/netlink or socket diagnostics. The sources describe an information leak that aids kernel address randomization bypass, not direct code execution. Exposure depends on the kernel version, which the sources do not list.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":3740,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99201':14A,17A '/proc/net/netlink':51B,112C '32':148C 'address':8A,58B,73B,168C,179C 'also':299C 'arg':217C 'assign':189C 'avail':300C 'avoid':88C 'backport':315C 'barrier':288C 'bind':123C 'bit':142C,149C 'bucket':48B,120C,137C 'built':213C 'call':269C 'callback':285C 'chang':236C,312C 'chosen':126C 'cleanup':271C 'compar':216C,245C 'comparison':184C 'consist':225C 'control':108C 'cooki':75B,181C,242C,297C 'could':46B 'cve':12A,15A 'defer':264C 'diagnost':54B,115C 'distinguish':135C 'equal':136C 'exit':278C 'expos':116C 'final':266C 'fix':63B 'follow':82C 'free':290C 'hash':4A,31B,89C,146C,210C,261C 'host':24B,28B 'id':110C,130C,295C 'imag':158C 'includ':98C,250C 'infer':47B 'init':60B,170C,218C 'initi':195C,302C 'insert':221C 'instead':76B,186C 'jenkin':145C 'keep':219C 'kernel':2A,20B,36B,80C,157C,309C 'kernel-imag':156C 'key':64B,97C,185C,207C 'later':319C 'leak':5A 'lifetim':204C 'limit':153C 'linux':1A,19B,79C 'linux-kernel':18B 'local':44B 'lookup':206C,220C 'low':141C 'make':310C 'method':279C 'multi':22B 'multi-user-host':21B 'namespac':7A,41B,69B,92C,174C,202C,228C,241C,252C,291C 'need':234C 'neither':230C 'net':61B,74B,102C,171C,180C,194C,272C,277C,296C,305C 'netlink':3A,30B,87C,95C,127C,215C,244C,254C 'network':6A,40B,91C 'non':72B,178C 'non-address':71B,177C 'ns.ns':294C 'object':209C 'offlin':164C 'older':307C 'order':49B,121C 'outstand':283C 'per':193C,276C 'per-net':192C,275C 'pointer':37B,93C,103C 'port':109C,129C 'preserv':227C 'public':231C 'put':267C 'raw':35B,100C 'rcu':249C,270C,284C,287C 'read':237C 'reader':11A,133C 'rebind':125C 'recov':56B,139C,166C 'rehash':224C 'releas':255C 'remain':198C 'remov':222C,256C 'resolv':86C 'rhashtabl':96C 'run':196C,273C 'runtim':25B 'safe':247C 'search':163C 'seed':150C 'self':27B 'self-host':26B 'separ':229C 'set':154C 'setup':304C 'slide':159C 'socket':53B,114C,239C,258C 'stabl':308C 'still':212C 'storag':292C 'straightforward':313C 'struct':101C 'tabl':32B,66B,118C,232C,262C 'teardown':253C 'unchang':199C 'uniqu':176C 'unlik':293C 'unprivileg':10A,43B,132C 'use':33B,172C 'user':23B,45B,107C 'user-control':106C 'usersock':128C 'v5.15':317C 'via':50B 'vulner':83C 'wait':281C 'walker':233C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without this netlink fix, where unprivileged local users can read /proc/net/netlink or socket diagnostics. The sources describe an information leak that aids kernel address randomization bypass, not direct code execution. Exposure depends on the kernel version, which the sources do not list.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99201","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}