CVE-2026-99201
Description
A flaw was found in the Linux kernel's netlink subsystem. An unprivileged local user can exploit this vulnerability by manipulating netlink sockets with chosen port identifiers and observing exposed table bucket order. This flaw results in an information disclosure, allowing an attacker to infer sensitive internal kernel memory addresses and potentially bypass Kernel Address Space Layout Randomization (KASLR).
Statement
This vulnerability is rated as Low severity because it is restricted to local access and solely facilitates KASLR bypass rather than granting direct privilege escalation or causing a denial of service. By analyzing hash bucket ordering across netlink socket interfaces, an authenticated local attacker can determine internal pointer addresses. To achieve elevated privileges, this information disclosure must be combined with a separate exploitable security flaw.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
An information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Debugging information helps an adversary learn about the system and form an attack plan. Using other weaknesses, an attacker could cause errors to occur; the response to these errors can reveal detailed system information, along with other impacts. An attacker can use messages that reveal technologies, operating systems, and product versions to tune the attack against known vulnerabilities in these technologies.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
