CVE-2026-99201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99201", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.400Z", "datePublished": "2026-10-28T10:35:56.069Z", "dateUpdated": "2026-10-30T12:42:51.128Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:51.128Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace's lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket's namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netlink/af_netlink.c"], "versions": [{"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "c61431f3b8c9824e9848a0308054f92b27fa7794", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "c03fb9c4be3b2dd0996d91e54f65407f7f475238", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "41a2f69f091b0765f17890d8ac04852c12f25cf6", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "18edcb9945118beb7a1b64a31a7370ecab485a79", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "status": "affected", "versionType": "git"}, {"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "lessThan": "f88bb3606e4bd11ee035b682cddc2999e604609a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netlink/af_netlink.c"], "versions": [{"version": "4.1", "status": "affected"}, {"version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c61431f3b8c9824e9848a0308054f92b27fa7794"}, {"url": "https://git.kernel.org/stable/c/f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9"}, {"url": "https://git.kernel.org/stable/c/c03fb9c4be3b2dd0996d91e54f65407f7f475238"}, {"url": "https://git.kernel.org/stable/c/41a2f69f091b0765f17890d8ac04852c12f25cf6"}, {"url": "https://git.kernel.org/stable/c/18edcb9945118beb7a1b64a31a7370ecab485a79"}, {"url": "https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b"}, {"url": "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28"}, {"url": "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"}], "title": "netlink: avoid hashing the network namespace pointer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netlink/af_netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c61431f3b8c9824e9848a0308054f92b27fa7794", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "c03fb9c4be3b2dd0996d91e54f65407f7f475238", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "41a2f69f091b0765f17890d8ac04852c12f25cf6", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "18edcb9945118beb7a1b64a31a7370ecab485a79", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}, {"lessThan": "f88bb3606e4bd11ee035b682cddc2999e604609a", "status": "affected", "version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netlink/af_netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace's lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket's namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later."}], "id": "CVE-2026-99201", "lastModified": "2026-10-30T13:21:52.503", "metrics": {}, "published": "2026-10-28T11:17:41.250", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18edcb9945118beb7a1b64a31a7370ecab485a79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41a2f69f091b0765f17890d8ac04852c12f25cf6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c03fb9c4be3b2dd0996d91e54f65407f7f475238"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c61431f3b8c9824e9848a0308054f92b27fa7794"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Information disclosure via netlink network namespace pointer hashing", "id": "2562684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562684"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-497", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetlink: avoid hashing the network namespace pointer\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\nUse the namespace's unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace's lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\nReading the socket's namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later.", "A flaw was found in the Linux kernel's netlink subsystem. An unprivileged local user can exploit this vulnerability by manipulating netlink sockets with chosen port identifiers and observing exposed table bucket order. This flaw results in an information disclosure, allowing an attacker to infer sensitive internal kernel memory addresses and potentially bypass Kernel Address Space Layout Randomization (KASLR)."], "name": "CVE-2026-99201", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-28T10:35:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99201\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99201\nhttps://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28\nhttps://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b\nhttps://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "statement": "This vulnerability is rated as Low severity because it is restricted to local access and solely facilitates KASLR bypass rather than granting direct privilege escalation or causing a denial of service. By analyzing hash bucket ordering across netlink socket interfaces, an authenticated local attacker can determine internal pointer addresses. To achieve elevated privileges, this information disclosure must be combined with a separate exploitable security flaw.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,bdd55b8a8acbf6b4840ab420eb6a63774bf4593b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,078deff25f8a849ecd1c3fe17b1e473b1cf44f28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,f88bb3606e4bd11ee035b682cddc2999e604609a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1,4.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,bdd55b8a8acbf6b4840ab420eb6a63774bf4593b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,078deff25f8a849ecd1c3fe17b1e473b1cf44f28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c428ecd1a21f1457ca3beb4df71b8a079c410e41,f88bb3606e4bd11ee035b682cddc2999e604609a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1,4.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:30:17.668479+00:00", "updated": "2026-11-03T02:00:08.609348+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}