CVE-2026-43403

What it actually does

The vulnerability is an authorization bypass in nsfs that permits processes with certain privileges to iterate and inspect namespaces belonging to other privileged processes, bypassing isolation intended by may_see_all_namespaces checks.

Why it matters to the business

Attackers on the same host can leak sensitive namespace and process information between services, increasing risk of lateral movement or data exposure in multi-tenant, container, or privileged-daemon environments; low EPSS and no known exploitation reduce immediate urgency but kernel-wide impact affects many Linux deployments.

How an attack unfolds

An attacker with local unprivileged or low-privileged access invokes ns iteration ioctls on /proc/*/ns/* entries; the missing centralized permission check allows visibility into foreign namespaces that should remain hidden, enabling information gathering about other services.

How to fix it

Upgrade the Linux kernel to a version containing the nsfs permission tightening commit that enforces may_see_all_namespaces() on iteration ioctls; rebuild and reboot affected systems, and verify the helper is present in nsfs code paths.

How to confirm the fix worked

Inspect kernel source or running kernel for presence of the may_see_all_namespaces() guard on ns iteration ioctl handlers; confirm that attempts by one privileged service to view another service's namespaces are denied.

Typical attack path

1. Obtain local shell or process execution on a Linux host
2. Identify target processes via procfs or other means
3. Call ns iteration ioctls without proper may_see_all_namespaces enforcement
4. Observe foreign namespace identifiers and metadata
5. Use leaked information to inform further attacks such as container escape or privilege escalation

How to detect it

Review kernel audit logs and nsfs-related syscalls for ioctl sequences on namespace files that cross privilege boundaries; correlate with process creation events showing unexpected namespace visibility.

What your security team should do

• Prioritize kernel updates on multi-tenant or container hosts within normal patch cycles given low exploit maturity
• Audit custom privileged daemons that interact with nsfs ioctls
• Monitor for future backports to long-term supported kernels
• Review namespace isolation assumptions in security tooling and container runtimes