CVE-2025-21659

In the Linux kernel, the following vulnerability has been resolved:

netdev: prevent accessing NAPI instances from another namespace

The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock.

napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().

This vulnerability is rated as Moderate severity because exploitation requires local system access and cannot be triggered remotely over the network. Under typical Red Hat Enterprise Linux deployments, an attacker must have sufficient privileges to issue Generic Netlink commands, and the potential impact is primarily limited to denial of service or namespace isolation bypass without direct privilege escalation. Consequently, while container or network namespace isolation is weakened, the overall system integrity remains intact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.