CVE-2026-43403

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43403", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.007Z", "datePublished": "2026-05-08T14:21:44.204Z", "dateUpdated": "2026-08-05T12:27:47.212Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:47.212Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnsfs: tighten permission checks for ns iteration ioctls\n\nEven privileged services should not necessarily be able to see other\nprivileged service's namespaces so they can't leak information to each\nother. Use may_see_all_namespaces() helper that centralizes this policy\nuntil the nstree adapts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached by a local `ioctl()` on an nsfs mount-namespace file descriptor, such as one obtained from `/proc/self/ns/mnt` or pidfd namespace ioctls. There is no network, adjacent, or physical attack path.\nAC:L - Triggering is deterministic: open a mount namespace fd and issue `NS_MNT_GET_NEXT` or `NS_MNT_GET_PREV`. There is no race or special memory-layout condition required.\nPR:L - The pre-fix check only required `CAP_SYS_ADMIN` in the target mount namespace's owning user namespace, which can be satisfied through user namespaces in plausible deployments. Under the higher-severity rule, this is Low rather than High.\nUI:N - No victim interaction is needed once the attacker has local execution and the relevant namespace capability. The attacker directly invokes the ioctl.\nS:C - The bug lets one namespace-confined service obtain file descriptors for other mount namespaces, bypassing the intended namespace visibility boundary. That can cross container or service isolation boundaries.\nC:H - The returned namespace fd and mount namespace id allow enumeration with `listmount()` and `statmount()`, exposing mount topology, paths, sources, options, and related metadata from another namespace. In plausible privileged-container scenarios, the fd can also enable `setns()` into the target mount namespace and expose sensitive filesystem contents.\nI:H - With the leaked mount namespace fd and the same namespace capabilities required by the vulnerable path, an attacker can plausibly `setns()` into another mount namespace and modify writable files or mount state there. This can compromise integrity across the namespace boundary.\nA:H - After obtaining and entering another mount namespace in a privileged scenario, the attacker can disrupt that namespace by altering or unmounting resources or damaging writable files. This can cause high availability impact to the affected service or container."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nsfs.c", "include/linux/ns_common.h", "kernel/nscommon.c"], "versions": [{"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "lessThan": "3376b345df155ca36d8611857b41ff7d5183fc38", "status": "affected", "versionType": "git"}, {"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "lessThan": "2f3dea284c761c890d676f77d5e55c0c496b4ef4", "status": "affected", "versionType": "git"}, {"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "lessThan": "0ad650e60150eda789deca5e78a6a09d26bf8fc9", "status": "affected", "versionType": "git"}, {"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "lessThan": "e6b899f08066e744f89df16ceb782e06868bd148", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nsfs.c", "include/linux/ns_common.h", "kernel/nscommon.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3376b345df155ca36d8611857b41ff7d5183fc38"}, {"url": "https://git.kernel.org/stable/c/2f3dea284c761c890d676f77d5e55c0c496b4ef4"}, {"url": "https://git.kernel.org/stable/c/0ad650e60150eda789deca5e78a6a09d26bf8fc9"}, {"url": "https://git.kernel.org/stable/c/e6b899f08066e744f89df16ceb782e06868bd148"}], "title": "nsfs: tighten permission checks for ns iteration ioctls", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nsfs.c", "include/linux/ns_common.h", "kernel/nscommon.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3376b345df155ca36d8611857b41ff7d5183fc38", "status": "affected", "version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "versionType": "git"}, {"lessThan": "2f3dea284c761c890d676f77d5e55c0c496b4ef4", "status": "affected", "version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "versionType": "git"}, {"lessThan": "0ad650e60150eda789deca5e78a6a09d26bf8fc9", "status": "affected", "version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "versionType": "git"}, {"lessThan": "e6b899f08066e744f89df16ceb782e06868bd148", "status": "affected", "version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nsfs.c", "include/linux/ns_common.h", "kernel/nscommon.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF16B1DB-0D79-4F76-8B3C-57C79AB99F70", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnsfs: tighten permission checks for ns iteration ioctls\n\nEven privileged services should not necessarily be able to see other\nprivileged service's namespaces so they can't leak information to each\nother. Use may_see_all_namespaces() helper that centralizes this policy\nuntil the nstree adapts."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnsfs: endurecer las comprobaciones de permisos para las ioctls de iteraci\u00f3n de ns\n\nIncluso los servicios privilegiados no deber\u00edan necesariamente poder ver los espacios de nombres de otros servicios privilegiados para que no puedan filtrar informaci\u00f3n entre s\u00ed. Usar el asistente may_see_all_namespaces() que centraliza esta pol\u00edtica hasta que el nstree se adapte."}], "id": "CVE-2026-43403", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-08T15:16:51.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ad650e60150eda789deca5e78a6a09d26bf8fc9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f3dea284c761c890d676f77d5e55c0c496b4ef4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3376b345df155ca36d8611857b41ff7d5183fc38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6b899f08066e744f89df16ceb782e06868bd148"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nsfs: tighten permission checks for ns iteration ioctls", "id": "2468250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468250"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-280", "details": ["A flaw was found in the Linux kernel's `nsfs` component. This vulnerability allows privileged services to bypass permission checks related to namespace iteration input/output controls (ioctls). As a result, one privileged service could potentially view information from other privileged services, leading to unauthorized information disclosure."], "name": "CVE-2026-43403", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43403\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43403\nhttps://lore.kernel.org/linux-cve-announce/2026050840-CVE-2026-43403-3869@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a1d220d9dafa8d76ba60a784a1016c3134e6a1e8,3376b345df155ca36d8611857b41ff7d5183fc38)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a1d220d9dafa8d76ba60a784a1016c3134e6a1e8,2f3dea284c761c890d676f77d5e55c0c496b4ef4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a1d220d9dafa8d76ba60a784a1016c3134e6a1e8,0ad650e60150eda789deca5e78a6a09d26bf8fc9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a1d220d9dafa8d76ba60a784a1016c3134e6a1e8,e6b899f08066e744f89df16ceb782e06868bd148)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T17:15:16.437346+00:00", "updated": "2026-05-21T21:00:16.445555+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}