SB20260816393 - Information disclosure in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2026-72127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in netdev_nl_napi_fill_one() when handling NETDEV_CMD_NAPI_GET requests from a child pid namespace. A remote attacker can issue a NETDEV_CMD_NAPI_GET request to disclose sensitive information.

The issue occurs because the reported NAPI kthread PID is returned from the initial pid namespace instead of the caller's pid namespace.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f24c0d01db214c9e661915e9972404c96ca73c0
• https://git.kernel.org/stable/c/5e4c8e08ce95730c87d6ada0bdbe1131a3c06393
• https://git.kernel.org/stable/c/fb18095389fe81f140d39585a2624aca9d42227e
• https://git.kernel.org/stable/c/fd750b694f1f9e1ecb8ca19314e4e21edbb15f42