An rmnet device remains linked to its real device after it is moved to a different network namespace. When it is used as a master, rmnet_add_bridge() follows that pointer and switches the real device's port to bridge mode. The rtnetlink master operation only requires CAP_NET_ADMIN in the namespace holding the visible rmnet and slave devices. A caller privileged only there can therefore bridge an attacker-controlled interface to the real device in another namespace, receiving and transmitting raw traffic across the namespace boundary. Require CAP_NET_ADMIN in the network namespace of the real device before configuring the bridge. Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean --- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c index bed6f63facf2..45e6c16a5a70 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c @@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, struct rmnet_port *port, *slave_port; int err; + /* + * The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev), + * but bridge mode below controls real_dev, which may live in another + * netns. + */ + if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev))) + return -EPERM; + port = rmnet_get_port_rtnl(real_dev); /* If there is more than one rmnet dev attached, its probably being