Cloudanix VulnDB

CVE-2026-99201

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel lets attackers figure out hidden internal memory addresses, making it easier for them to break into the system.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw exposes low bits of a Jenkins hash over a raw network namespace pointer in the netlink rhashtable, allowing an unprivileged process to recover the kernel address of init_net by observing bucket order via /proc/net/netlink and socket diagnostics combined with chosen port ID rebinding.

Why it matters to the business

Attackers can obtain kernel memory layout information on affected Linux systems, which significantly eases subsequent kernel exploitation and increases the likelihood of successful privilege escalation or system compromise.

How an attack unfolds

An attacker binds and rebinds specific NETLINK_USERSOCK port IDs to observe collisions in the exposed rhashtable buckets, recovers partial hash values, then uses the known 32-bit seed and limited kernel slide set to brute-force the init_net address offline.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the raw struct net pointer with the namespace net_cookie in the rhashtable key and comparison logic; backports to v5.15 and later are available.

How to confirm the fix worked

Confirm the presence of net_cookie usage inside netlink_compare_arg_init and netlink_compare functions; verify that socket diagnostics and /proc/net/netlink no longer expose raw pointer-derived bucket information.

Typical attack path

  1. Read bucket order from /proc/net/netlink or socket diag
  2. Bind chosen port IDs to netlink sockets to force hash collisions
  3. Rebind to distinguish equal buckets and extract low hash bits
  4. Combine recovered bits with known seed and slide candidates
  5. Offline search to obtain init_net kernel address

How to detect it

No reliable post-exploitation artifacts exist for this information disclosure alone; monitor for unusual netlink socket activity or repeated port ID binding patterns in system call audit logs.

What your security team should do

  • Prioritize kernel updates on all exposed Linux systems within the next patching cycle
  • Monitor vendor advisories for distribution-specific backports of the net_cookie change
  • Harden systems with KASLR and other kernel pointer leak mitigations until patched

The record

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By binding and rebinding chosen NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal buckets and recover the low bits of the Jenkins hash. Its 32-bit seed and the limited set of kernel-image slides can then be searched offline to recover the address of init_net. Use the namespace's unique, non-address net_cookie in the comparison key instead. It is assigned before the per-net initializers run and remains unchanged for the namespace's lifetime. The lookup key and object hash are still built by netlink_compare_arg_init(), keeping lookup, insertion, removal and rehashing consistent while preserving namespace separation. Neither public table walker needs to change. Reading the socket's namespace cookie in netlink_compare() is safe under RCU, including during namespace teardown. netlink_release() removes the socket from the hash table and defers its final put with call_rcu(). cleanup_net() runs the per-net exit methods and waits for outstanding RCU callbacks with rcu_barrier() before freeing namespace storage. Unlike ns.ns_id, net_cookie is also available and initialized during setup_net() in older stable kernels, making the change straightforward to backport to v5.15 and later.

Affected packages

Ecosystem Package Introduced Fixed