CVE-2026-98073

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by assigning conflicting alternative interface names to network devices across different network namespaces. When a non-root network namespace is deleted, the unresolved name conflict prevents the device from migrating back to the default namespace, resulting in a kernel failure during cleanup.

A low-impact flaw was found in the Linux kernel's handling of network device alternative names (altnames) during network namespace teardown. A local user with the privileges needed to configure network devices (CAP_NET_ADMIN in the relevant network namespaces) can assign the same alternative interface name to devices in different network namespaces. When the non-root network namespace is deleted, the unresolved name conflict causes __dev_change_net_namespace() to fail, triggering a kernel WARNING (for example in cfg80211_pernet_exit() or cfg802154_pernet_exit()) during cleanup and preventing the affected device from migrating back to the initial network namespace. The result is a local denial of service limited to the namespace cleanup path; there is no impact on confidentiality or integrity, and no memory corruption or privilege escalation is involved.

Multiple Red Hat Enterprise Linux 8, 9, and 10 update streams (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS 8 or 9 kernels are affected. Red Hat Enterprise Linux 7 and the RHEL 8.4 update stream are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are deferred given the low impact of this issue; the residual risk is a kernel warning and a failed network namespace cleanup triggered by an already-privileged local user, with availability impact confined to that cleanup path.

The CVEORG record scores this flaw as Important (CVSS 3.1 score 7.8, assuming high confidentiality, integrity, and availability impact), while Red Hat rates it Moderate (CVSS 3.1 score 5.5) with low impact, because the available evidence supports only an availability impact from a cleanup failure and kernel warning, not the confidentiality or integrity impact assumed in the CVEORG vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.