CVE-2026-72127

Received Received - Intake

Information Leak in Linux Kernel NAPI PID Reporting

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller's pid namespace netdev_nl_napi_fill_one() reports the NAPI kthread PID in NETDEV_A_NAPI_PID using task_pid_nr(), which returns the PID in the initial pid namespace. NETDEV_CMD_NAPI_GET does not have GENL_ADMIN_PERM and the netdev genl family is netnsok, so a caller in a child pid namespace can issue it. That caller then sees the kthread's global PID, even though the kthread is not visible in its pid namespace, where the value should be 0. Translate the PID through the caller's pid namespace, the same way commit 3799c2570982 ("io_uring/fdinfo: translate SqThread PID through caller's pid_ns") did for the io_uring SQPOLL thread. The doit and dumpit paths both run synchronously in the caller's context, so task_active_pid_ns(current) is the caller's pid namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72127

EUVD

EUVD-2026-58885

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect reporting of NAPI thread PIDs in child pid namespaces. The netdev_nl_napi_fill_one() function uses task_pid_nr(), which returns the PID in the initial pid namespace instead of the caller's pid namespace. This allows a caller in a child pid namespace to see the kthread's global PID, even though the kthread is not visible in their namespace.

Detection Guidance

This vulnerability is specific to the Linux kernel's netdev-genl subsystem and does not have direct network or system detection commands. It requires kernel code inspection or patch verification to confirm exposure. Check if your kernel version includes the fix by examining the netdev_nl_napi_fill_one() function in the kernel source.

Impact Analysis

This vulnerability could allow a process in a child pid namespace to access information about kernel threads that should be hidden. This may lead to information disclosure or unexpected behavior in containerized environments where pid namespaces are used for isolation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a Linux kernel issue where a PID is reported incorrectly in child pid namespaces, which is a technical security flaw but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the latest kernel security updates provided by your Linux distribution. If no patch is available, consider restricting access to NETDEV_CMD_NAPI_GET operations or isolating untrusted users in separate pid namespaces until the fix is applied.

Hi! I’m here to help you understand CVE-2026-72127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70