Exposure of System Data to an Unauthorized Control Sphere Affecting openshift/ose-rhel-coreos-9 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL8-OPENSHIFTOSERHELCOREOS9-22344070
- published8 Nov 2026
- disclosed28 Oct 2026
Introduced: 28 Oct 2026
NewCVE-2026-99201 (opens in a new tab)How to fix?
There is no fixed version for RHEL:8 openshift/ose-rhel-coreos-9.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift/ose-rhel-coreos-9 package and not the openshift/ose-rhel-coreos-9 package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid hashing the network namespace pointer
The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By binding and rebinding chosen NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal buckets and recover the low bits of the Jenkins hash. Its 32-bit seed and the limited set of kernel-image slides can then be searched offline to recover the address of init_net.
Use the namespace's unique, non-address net_cookie in the comparison key instead. It is assigned before the per-net initializers run and remains unchanged for the namespace's lifetime. The lookup key and object hash are still built by netlink_compare_arg_init(), keeping lookup, insertion, removal and rehashing consistent while preserving namespace separation. Neither public table walker needs to change.
Reading the socket's namespace cookie in netlink_compare() is safe under RCU, including during namespace teardown. netlink_release() removes the socket from the hash table and defers its final put with call_rcu(). cleanup_net() runs the per-net exit methods and waits for outstanding RCU callbacks with rcu_barrier() before freeing namespace storage.
Unlike ns.ns_id, net_cookie is also available and initialized during setup_net() in older stable kernels, making the change straightforward to backport to v5.15 and later.
References
- https://access.redhat.com/security/cve/CVE-2026-99201
- https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28
- https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b
- https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a
- https://git.kernel.org/stable/c/18edcb9945118beb7a1b64a31a7370ecab485a79
- https://git.kernel.org/stable/c/41a2f69f091b0765f17890d8ac04852c12f25cf6
- https://git.kernel.org/stable/c/c03fb9c4be3b2dd0996d91e54f65407f7f475238
- https://git.kernel.org/stable/c/c61431f3b8c9824e9848a0308054f92b27fa7794
- https://git.kernel.org/stable/c/f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9