CVE-2026-31692: Linux Kernel Privilege Escalation Flaw

CVE-2026-31692 Overview

CVE-2026-31692 is a Linux kernel vulnerability in the rtnetlink subsystem. The rtnl_newlink() function fails to perform a netlink_ns_capable() capability check on the peer network namespace when creating paired devices such as veth, vxcan, and netkit. An unprivileged user with access to a user namespace can create network interfaces in arbitrary network namespaces, including init_net. This breaks the isolation boundary that user namespaces are intended to provide for networking operations.

Critical Impact
Local unprivileged users with user namespace access can create network interfaces in privileged namespaces, undermining container isolation and enabling host-level availability impact.

Affected Products

Linux Kernel (mainline, prior to fix commit 0975b64ffb34)
Linux Kernel 7.0-rc1 through 7.0-rc7
Distributions shipping affected stable kernel branches without backported fixes

Discovery Timeline

2026-04-30 - CVE-2026-31692 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31692

Vulnerability Analysis

The vulnerability resides in rtnl_newlink(), the rtnetlink handler responsible for creating new network devices. When the kernel processes a request to create a paired device such as veth, vxcan, or netkit, it must place one endpoint in the caller's namespace and the peer endpoint in a separate target namespace specified by the user.

The kernel correctly validated CAP_NET_ADMIN in the source namespace but omitted the equivalent check against the peer network namespace. An unprivileged process that creates a new user namespace gains CAP_NET_ADMIN within that namespace by design. The missing check allowed that capability to be incorrectly honored when targeting other namespaces, including init_net, the host's primary network namespace.

This is a missing authorization check [CWE-862 class] in a privileged kernel code path. While confidentiality and integrity are unaffected, attackers can disrupt host networking through unexpected interface creation, exhausting resources or interfering with packet flow.

Root Cause

The root cause is an incomplete capability model in rtnl_newlink(). The function trusted the namespace identifier supplied by the caller without verifying whether the caller held CAP_NET_ADMIN over that peer namespace. Cross-namespace operations require capability validation in every namespace touched by the operation, not only the originating one.

Attack Vector

Exploitation requires local access and the ability to create user namespaces, a feature enabled by default on most modern distributions. A local attacker invokes clone() or unshare() with CLONE_NEWUSER to enter a new user namespace, then issues an RTM_NEWLINK netlink message specifying a target network namespace identifier referencing init_net or another privileged namespace. The kernel proceeds to create the paired device without verifying capabilities in the target namespace.

The upstream fix adds a netlink_ns_capable() check for CAP_NET_ADMIN against the peer namespace before device creation proceeds. See the patch commits 0975b64, 7b735ef, and d04cc16 for the corrective logic.

Detection Methods for CVE-2026-31692

Indicators of Compromise

Unexpected veth, vxcan, or netkit interfaces appearing in init_net without administrator action
Audit log entries showing RTM_NEWLINK netlink messages originating from unprivileged UIDs
Processes invoking unshare(CLONE_NEWUSER) followed by netlink writes targeting non-owned network namespaces

Detection Strategies

Enable Linux audit rules for netlink socket usage and RTM_NEWLINK operations from non-root users
Monitor /sys/class/net/ for new interface creation events using inotify or eBPF probes on register_netdevice
Correlate user namespace creation (unshare, clone with CLONE_NEWUSER) with subsequent rtnetlink activity from the same process tree

Monitoring Recommendations

Track kernel version inventory across Linux hosts and flag systems running unpatched 7.0-rc builds or affected stable branches
Alert on creation of veth/vxcan/netkit devices by processes outside container runtimes and orchestrators
Review sysctl kernel.unprivileged_userns_clone settings across the fleet to identify hosts where user namespaces are broadly accessible

How to Mitigate CVE-2026-31692

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisory and reboot affected hosts
Inventory kernel versions across servers, containers, and developer workstations to confirm patch coverage
Restrict unprivileged user namespace creation on systems that do not require it via sysctl kernel.unprivileged_userns_clone=0

Patch Information

The fix is committed upstream in 0975b64ffb34, 7b735ef81286, and d04cc16d3624. These commits add the missing netlink_ns_capable() check on the peer namespace inside rtnl_newlink(). Consume the fix through your distribution's stable kernel update channel.

Workarounds

Disable unprivileged user namespaces where workloads do not require them using sysctl -w kernel.unprivileged_userns_clone=0
Apply seccomp or AppArmor/SELinux profiles that block unshare(CLONE_NEWUSER) and rtnetlink writes for untrusted processes
Use namespace-aware capability policies in container runtimes to prevent cross-namespace device creation by workload containers

bash

# Configuration example: restrict unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-31692.conf

# Verify current kernel version against patched commits
uname -r