The flaw lies in the way the QRTR subsystem keeps all port and node information in module‑global variables, so there are no per‑network‑namespace checks on socket operations. An unprivileged process that creates an AF_QIPCRTR socket in a separate networking namespace can send QRTR datagrams—including control‑plane messages such as QRTR_TYPE_NEW_SERVER—to sockets that belong to other namespaces. Because the receiving socket reads the sender as node id 1, the message appears to come from a legitimate local client, thereby breaking the isolation that network namespaces are expected to provide. This represents a cross‑namespace access control flaw (CWE‑653).

All Linux kernel versions that lack the patch restricting AF_QIPCRTR socket creation to the init_net namespace are vulnerable. This encompasses a wide range of distributions and kernel releases prior to the fix, as the vulnerability is implemented in the core kernel code and not tied to a specific version range.

The EPSS score is reported as < 1 %, indicating a very low likelihood of widespread exploitation, and the CVSS score of 8.8 classifies the vulnerability as high severity. It is not listed in the CISA KEV catalog. The attack requires a local process that can invoke unshare(CLONE_NEWUSER | CLONE_NEWNET) and create an AF_QIPCRTR socket, making the attack vector local to the system.