CVE-2026-43390 Overview
CVE-2026-43390 is a Linux kernel information disclosure vulnerability in the nstree namespace listing subsystem. The flaw stems from insufficient permission checks that allowed one privileged service to enumerate namespaces belonging to other privileged services. Upstream maintainers resolved the issue by routing listing operations through the may_see_all_namespaces() helper, which centralizes the visibility policy. The vulnerability affects Linux kernel builds that include the nstree namespace listing functionality.
Critical Impact
Privileged services could observe namespaces owned by unrelated privileged services, enabling cross-service information leakage on shared Linux hosts.
Affected Products
- Linux kernel versions containing the nstree namespace listing code prior to the fix
- Distributions shipping stable kernels prior to the backported patch
- Multi-tenant Linux systems relying on namespace isolation between privileged services
Discovery Timeline
- 2026-05-08 - CVE-2026-43390 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43390
Vulnerability Analysis
The Linux kernel's nstree subsystem provides a structured view of namespaces present on a system. Before this fix, the listing path applied permission checks that were too permissive. Any caller holding elevated privileges could enumerate namespaces created by other privileged services, even when no functional need for cross-service visibility existed.
Namespaces underpin container isolation, sandboxing, and service segmentation on Linux. Disclosing the existence, identifiers, and counts of namespaces owned by another service breaks an implicit isolation boundary. Attackers operating from a compromised privileged service can use this information to map sibling services, enumerate container workloads, and plan lateral movement.
The upstream fix introduces a unified policy via the may_see_all_namespaces() helper. This helper centralizes the decision about whether the caller is allowed to observe namespaces beyond those it owns. Listing paths now defer to this helper until the broader nstree architecture adapts to enforce the policy natively.
Root Cause
The root cause is an authorization gap [CWE-285] in the nstree listing code. The previous logic conflated holding capability bits with the right to view all namespaces. It did not distinguish between privilege within a service and visibility across services, producing an information exposure condition [CWE-200].
Attack Vector
A local attacker with control of one privileged service queries the nstree listing interface. The kernel returns metadata for namespaces owned by other privileged services on the same host. No memory corruption or code execution occurs; the impact is confidentiality loss of namespace topology used for reconnaissance.
No verified public exploit code is available. Technical mechanics are documented in the upstream commits at kernel.org commit 0abd8164 and kernel.org commit 8d76afe8.
Detection Methods for CVE-2026-43390
Indicators of Compromise
- Unexpected reads against nstree listing interfaces from services that do not require cross-namespace visibility
- Privileged processes enumerating namespace identifiers outside their assigned workload scope
- Audit records showing reconnaissance patterns where a service repeatedly queries kernel namespace metadata
Detection Strategies
- Enable kernel audit rules for syscalls that interact with namespace listing and review caller process context
- Baseline which privileged services legitimately query nstree and alert on deviations
- Correlate namespace enumeration activity with subsequent attempts to access sibling service resources
Monitoring Recommendations
- Track uname, capability sets, and namespace identifiers for processes invoking namespace introspection APIs
- Forward kernel audit logs to a centralized analytics platform for cross-host correlation
- Monitor for privileged service compromise indicators that typically precede reconnaissance against neighboring workloads
How to Mitigate CVE-2026-43390
Immediate Actions Required
- Apply the stable kernel update containing the may_see_all_namespaces() helper change as soon as your distribution publishes it
- Inventory hosts running multiple privileged services in shared kernel namespaces and prioritize them for patching
- Restrict which services run with capabilities sufficient to query nstree listings
Patch Information
The vulnerability is resolved by the upstream commits 0abd81645fc95ec6a9d4e4813000f22c5efc0ff4 and 8d76afe84fa2babf604b3c173730d4d2b067e361. The fix routes namespace listing through may_see_all_namespaces() to enforce a centralized visibility policy. Track your distribution's stable kernel advisories for the corresponding backport.
Workarounds
- Reduce the capability set assigned to privileged services so they cannot reach the nstree listing path
- Separate mutually distrusting privileged services onto distinct hosts or VMs until patched kernels are deployed
- Apply Linux Security Module policies that constrain access to namespace introspection interfaces
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
