Post #2707386
2026-05-07 22:01 UTC
@hailey@hails.org AFAICT AF_NETLINK has nothing to do with the vuln. It's just the underlying mechanism for a lot of normal things. In this case user namespaces would even be a more plausible culprit for allowing users to reach the vulnerable code than AF_NETLINK is. But the culprit is splice and all the gratuitous zerocopy stuff you don't need unless you're trying to serve a video streaming platform with millions of users.
Replies (1)
-
@hailey@hails.org 2026-05-07 23:17
@dalias@hachyderm.io it looks like AF_NETLINK is in the critical path of the exploit poc at least? see add_xfrm_sa, it it responsible for actually writing the shellcode and does so via a netlink socket