# CVE-2026-99201: netlink: avoid hashing the network namespace pointer


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Updated:** 28 Oct 2026
- **Also known as:** AZL-111362, DEBIAN-CVE-2026-99201, GHSA-q237-q634-6984, UBUNTU-CVE-2026-99201

## What is CVE-2026-99201?

CVE-2026-99201 is a vulnerability in Linux, published on 28 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

netlink: avoid hashing the network namespace pointer

The netlink rhashtable key includes a raw struct net pointer and a
user-controlled port ID. Both /proc/net/netlink and socket diagnostics
expose the table's bucket order. By binding and rebinding chosen
NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
buckets and recover the low bits of the Jenkins hash. Its 32-bit seed
and the limited set of kernel-image slides can then be searched offline
to recover the address of init_net.

Use the namespace's unique, non-address net_cookie in the comparison
key instead. It is assigned before the per-net initializers run and
remains unchanged for the namespace's lifetime. The lookup key and
object hash are still built by netlink_compare_arg_init(), keeping
lookup, insertion, removal and rehashing consistent while preserving
namespace separation. Neither public table walker needs to change.

Reading the socket's namespace cookie in netlink_compare() is safe
under RCU, including during namespace teardown. netlink_release()
removes the socket from the hash table and defers its final put with
call_rcu(). cleanup_net() runs the per-net exit methods and waits for
outstanding RCU callbacks with rcu_barrier() before freeing namespace
storage.

Unlike ns.ns_id, net_cookie is also available and initialized during
setup_net() in older stable kernels, making the change straightforward
to backport to v5.15 and later.

## Which versions are affected by CVE-2026-99201?


## How do I fix CVE-2026-99201?

Upgrade to a fixed version.

## Is CVE-2026-99201 being exploited?

There is no known exploitation of CVE-2026-99201 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99201 and fix it if it is affected.

What it is: CVE-2026-99201 is a vulnerability in Linux, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99201 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99201/ (Markdown: https://insights.sbomify.com/CVE-2026-99201/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99201
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99201
- OSV: https://osv.dev/vulnerability/CVE-2026-99201

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99201/
Summaries are generated and may contain mistakes; the official description above is the record.