Subject: Re: [PATCH] rtnetlink: add missing netlink_ns_capable() check for peer netns

From: Jakub Kicinski <[email-masked]>
Date: Thu, 26 Mar 2026 20:36:46 -0700

On Tue, 24 Mar 2026 09:07:30 +0100 Nikolaos Gkarlis wrote:
> rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
> network namespace when creating paired devices (veth, vxcan,
> netkit). This allows an unprivileged user with a user namespace
> to create interfaces in arbitrary network namespaces, including
> init_net.
> 
> Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
> namespace before allowing device creation to proceed.
> 
> Fixes: 48327566769a ("rtnetlink: fix double call of rtnl_link_get_net_ifla()")

AI assistant here suggests this is not the valid Fixes tag,
which seems true on the surface. This commit was fixing
cleanup, IDK how it could break input validation?

> Reported-by: Nikolaos Gkarlis <[email-masked]>

Reported-by tags are only when the reporter is different than author
the Google's bounty program rules have been amended to make this
explicit, please let us know if other programs still mislead people

> Signed-off-by: Nikolaos Gkarlis <[email-masked]>
-- 
pw-bot: cr