In the Linux kernel, the rtnl_newlink function omitted a capability check on the peer network namespace when creating paired devices such as veth, vxcan, or netkit. This flaw allows an unprivileged user who has created a user namespace to add interfaces to any network namespace, including the system’s init_net. The missing check grants the attacker the equivalent of CAP_NET_ADMIN in the peer namespace, enabling unauthorized manipulation of network topology and potential abuse of network resources. The weakness is an improper access control failure and a least privilege violation (CWE‑272).

All Linux kernel versions that have not yet incorporated the fix are vulnerable. The flaw manifests when creating veth, vxcan, or netkit interfaces in any user‑created or system network namespace. No specific upstream version numbers are provided, so any kernel not yet patched by the referenced commit is affected.

The CVSS score of 5.5 indicates medium severity. The EPSS score of < 1 % indicates a low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user possessing a user namespace, which can be set up by an unprivileged user. Because the flaw allows creation of interfaces in arbitrary namespaces, the impact could range from unauthorized network topology changes to potential privilege escalation if combined with other kernel weaknesses.