CVE-2026-72127

Descrição

In the Linux kernel, the following vulnerability has been resolved: netdev-genl: report NAPI thread PID in the caller-s pid namespace netdev_nl_napi_fill_one() reports the NAPI kthread PID in NETDEV_A_NAPI_PID using task_pid_nr(), which returns the PID in the initial pid namespace. NETDEV_CMD_NAPI_GET does not have GENL_ADMIN_PERM and the netdev genl family is netnsok, so a caller in a child pid namespace can issue it. That caller then sees the kthread-s global PID, even though the kthread is not visible in its pid namespace, where the value should be 0. Translate the PID through the caller-s pid namespace, the same way commit 3799c2570982 (-io_uring/fdinfo: translate SqThread PID through caller-s pid_ns-) did for the io_uring SQPOLL thread. The doit and dumpit paths both run synchronously in the caller-s context, so task_active_pid_ns(current) is the caller-s pid namespace.