In the Linux kernel the rtnl_newlink function omitted a capability check on the peer network namespace when creating paired devices such as veth, vxcan, or netkit. This flaw allows an unprivileged user who has created a user namespace to add interfaces to any network namespace, including the system’s init_net. The missing check grants the attacker the equivalent of CAP_NET_ADMIN in the peer namespace, enabling unauthorized manipulation of network topology and potential abuse of network resources. The weakness is an improper access control failure, categorized as CWE‑284.

All Linux kernel versions that have not yet incorporated the fix are vulnerable. The flaw manifests when creating veth, vxcan, or netkit interfaces in any user‑created or system network namespace. No specific upstream version numbers are provided, so any kernel not yet patched by the referenced commit is affected.

The CVSS score is not disclosed in the data, and the EPSS score is unavailable, making the exploitation probability unclear. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a local user possessing a user namespace, which can be set up by an unprivileged user. Because the flaw allows creation of interfaces in arbitrary namespaces, the impact could range from network isolation breaches to more extensive privilege escalation if combined with other kernel weaknesses.