In the Linux kernel, the netdev-genl subsystem reports the NAPI kthread PID using task_pid_nr(). That function returns the PID in the initial, global pid namespace instead of translating it to the caller’s namespace. The NETDEV_CMD_NAPI_GET command lacks GENL_ADMIN_PERM and the netdev genl family is marked netnsok, allowing a process inside a child pid namespace to invoke it. Consequently, the caller receives the global PID of a kernel NAPI thread, even though that thread is invisible in its own namespace where the correct value should be zero. This exposes kernel thread identifiers that should remain opaque to the caller, constituting an information‑exposure vulnerability.

The issue exists in the Linux kernel itself. Any host running an unpatched kernel that contains the netdev‑genl implementation is affected. Because no specific kernel version range is indicated, the entire distribution is potentially vulnerable until the namespace‑translation fix is incorporated into an released kernel revision.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. The likely attack vector is a local process capable of creating or entering a child pid namespace—a capability broadly available on Linux systems. The vulnerability is local and does not require remote interaction. The CVSS score of 5.5 assigns a moderate severity, but the low EPSS and lack of exposure to remote users suggest the overall risk is low.