Executive brief
The Linux kernel's network device generic netlink interface can leak internal process identifiers (PIDs) across process namespace boundaries. When a container or sandboxed process queries NAPI thread information, it receives the global PID instead of a namespace-appropriate value, exposing information about host processes that should remain invisible within the container. This information leakage could aid attackers in fingerprinting kernel internals or targeting specific processes.
Technical details
The vulnerability is an information disclosure flaw in the netdev-genl subsystem (net/core/netdev-genl.c). The netdev_nl_napi_fill_one() function reports NAPI kthread PIDs using task_pid_nr(), which returns PIDs in the initial (host) namespace rather than translating them through the caller's namespace context. The NETDEV_CMD_NAPI_GET command lacks GENL_ADMIN_PERM permission checks and the netdev genl family is network-namespace-aware (netnsok), allowing unprivileged callers in child PID namespaces to query this information. An attacker in a container can thus obtain global PIDs of kernel threads that should be invisible in their namespace (where the value should be 0). The fix translates PIDs through the caller's active PID namespace using task_pid_nr_ns() and task_active_pid_ns(current), aligning with the io_uring SQPOLL thread fix pattern.
Affected products
- Linux Linux kernel Multiple kernel versions (fix applied across linux-5.x, linux-6.x, linux-7.x series; earliest mention linux-4.x)
Timeline
- 2026-08-15: disclosed
- 2026-06-17: patched: Upstream fix merged; backported to stable trees
- 2026-06: other: Patch authored 2026-06-16, committed 2026-06-17