SB2026102972 - Information disclosure in Linux kernel netlink

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2026-99201)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose the kernel address of init_net.

The vulnerability exists due to information exposure through hashing a raw network namespace pointer in the netlink rhashtable key when exposing hash table bucket order through /proc/net/netlink and socket diagnostics. A local user can bind and rebind chosen NETLINK_USERSOCK port IDs to identify matching buckets, recover low bits of the Jenkins hash, and search the hash seed and possible kernel-image slides offline to recover the address of init_net.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28
• https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b
• https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a