Security readout for executives and security teams
Plain-English summary
A Linux kernel permission flaw could let a locally authenticated, low-privilege actor open namespace handles belonging to privileged services that should remain isolated. This may expose sensitive cross-service information and weaken security boundaries. The supplied CVSS score is 8.8, but exploitation requires local access.
Executive priority
Treat this as an accelerated patching priority for shared or isolation-sensitive Linux hosts. The high CVSS score supports urgency, while the local attack requirement and lack of cited active exploitation make it less urgent than an internet-exploitable emergency. Obtain distribution-specific fixed-version guidance before scheduling deployment.
Technical view
The nsfs handle-opening path lacked the centralized may_see_all_namespaces() authorization policy. Consequently, privilege alone could permit visibility into another privileged service’s namespaces. The resolution tightens this check. The supplied CVSS vector reports local, low-complexity exploitation with low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is most relevant on affected Linux systems where untrusted or compromised local users and services can interact with namespace handles. Multi-service, containerized, or shared-host environments may warrant extra attention. The supplied affected-version data names 6.18, 6.18.50, 6.19.9, and 7.0, but does not clearly define complete vulnerable ranges.
Exploitation context
The bundle marks this CVE as absent from KEV, and no supplied source claims active exploitation or provides a public exploit. The attack vector is local, so this is not presented as a direct unauthenticated network compromise. A foothold or low-privilege local access is required according to the CVSS vector.
Researcher notes
The record provides three stable-kernel commits but does not map them to branches or clearly express affected ranges. No CWE, proof of concept, detection signature, or exploitation telemetry is supplied. The description directly supports namespace visibility and information-leak risk; the CVSS high integrity and availability impacts are asserted but not explained in the provided narrative.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced nsfs permission fix.
- Confirm distribution advisories before interpreting the incomplete affected-version list.
- Restrict local access and minimize privileges granted to exposed or untrusted services.
- Prioritize shared, containerized, and multi-service hosts where namespace isolation is security-critical.
Validation and detection
- Record each system’s running kernel version and distribution build identifier.
- Compare installed builds with the distribution vendor’s affected and fixed package guidance.
- Verify the deployed kernel includes the may_see_all_namespaces() authorization change.
- Review local users and services capable of interacting with namespace handles.
- Regression-test namespace-dependent workloads after updating the kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/24ebaf6676ae4f74f4856eb645959b15e62bc1b4CVE reference, Linux
- https://git.kernel.org/stable/c/1797ee11451f1b2be69863a9f5bd43b948813fdfCVE reference, Linux
- https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.