{"apiVersion":"1.0","identifier":"CVE-2026-72127","description":"In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller-s pid namespace netdev_nl_napi_fill_one() reports the NAPI kthread PID in NETDEV_A_NAPI_PID using task_pid_nr(), which returns the PID in the initial pid namespace. NETDEV_CMD_NAPI_GET does not have GENL_ADMIN_PERM and the netdev genl family is netnsok, so a caller in a child pid namespace can issue it. That caller then sees the kthread-s global PID, even though the kthread is not visible in its pid namespace, where the value should be 0. Translate the PID through the caller-s pid namespace, the same way commit 3799c2570982 (-io_uring/fdinfo: translate SqThread PID through caller-s pid_ns-) did for the io_uring SQPOLL thread. The doit and dumpit paths both run synchronously in the caller-s context, so task_active_pid_ns(current) is the caller-s pid namespace.","publishedAt":"2026-08-15T06:21:30","lastModifiedAt":"2026-08-17T06:18:12","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72127","cvssScore":null,"cvssVector":"Pending","epssProbability":0.002,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72127","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72127","en":"https://www.redsauce.net/en/cves/CVE-2026-72127","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72127","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72127","de":"https://www.redsauce.net/de/cves/CVE-2026-72127","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72127","el":"https://www.redsauce.net/el/cves/CVE-2026-72127"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72127"}}