---
id: CVE-2026-31692
title: 'rtnetlink: add missing netlink_ns_capable() check for peer netns'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rtnetlink: add missing netlink_ns_capable() check for peer netns

  rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
  network namespace when creating pair…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 <
    0975b64ffb34560042090a5986c3a02e6c80f36f
  - >-
    Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 <
    d04cc16d3624218a5458b2b664ae431f1b3b334d
  - >-
    Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 <
    7b735ef81286007794a227ce2539419479c02a5f
  - Linux 2.6.33
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:24:27.396675Z'
published: '2026-04-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:23.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31692'
references:
  - url: 'https://git.kernel.org/stable/c/0975b64ffb34560042090a5986c3a02e6c80f36f'
  - url: 'https://git.kernel.org/stable/c/d04cc16d3624218a5458b2b664ae431f1b3b334d'
  - url: 'https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01773
ingestedAt: '2026-11-06T15:54:04.045Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: add missing netlink_ns_capable() check for peer netns

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
network namespace when creating paired devices (veth, vxcan,
netkit). This allows an unprivileged user with a user namespace
to create interfaces in arbitrary network namespaces, including
init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
namespace before allowing device creation to proceed.

## Affected

- `Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 < 0975b64ffb34560042090a5986c3a02e6c80f36f`
- `Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 < d04cc16d3624218a5458b2b664ae431f1b3b334d`
- `Linux >= 81adee47dfb608df3ad0b91d230fb3cef75f0060 < 7b735ef81286007794a227ce2539419479c02a5f`
- `Linux 2.6.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.