The flaw lies in the way the QRTR subsystem keeps all port and node information in module‑global variables, so there are no per‑network‑namespace checks on socket operations. An unprivileged process that creates an AF_QIPCRTR socket in a separate networking namespace can send QRTR datagrams—including control‑plane messages such as QRTR_TYPE_NEW_SERVER—to sockets that belong to other namespaces. Because the receiving socket reads the sender as node id 1, the message appears to come from a legitimate local client, thereby breaking the isolation that network namespaces are expected to provide. This represents a cross‑namespace access control flaw (CWE‑862).

Based on the description, it is inferred that all Linux kernel versions without the patch restricting AF_QIPCRTR socket creation to the init_net namespace are vulnerable, encompassing a wide range of distributions and kernel releases before the fix. This vulnerability is part of the core kernel code and is not limited to a specific version range.

The EPSS score is reported as < 1 %, indicating a very low likelihood of widespread exploitation, and the CVSS score of 8.8 classifies the vulnerability as high severity. It is not listed in the CISA KEV catalog. The attack requires a local process that can invoke unshare(CLONE_NEWUSER | CLONE_NEWNET) and create an AF_QIPCRTR socket, making the attack vector local to the system.