CVE-2021-46912 is a vulnerability in the Linux kernel related to the handling of the tcp_allowed_congestion_control sysctl parameter within network namespaces (netns). In Linux, network namespaces provide isolation of network resources for containers or virtualized environments. The vulnerability arises because tcp_allowed_congestion_control is implemented as a global writable variable rather than being properly isolated per network namespace. This means that writing to tcp_allowed_congestion_control in one network namespace inadvertently affects all other namespaces, breaking the intended isolation. The root cause is that tcp_allowed_congestion_control and tcp_available_congestion_control are the only sysctls in the ipv4_net_table (the per-netns sysctl table) with a NULL data pointer, and their handlers do not reference a struct net, causing them to operate globally. Attempts to fix this by updating the data pointer logic fail because the data pointer is NULL, and the ipv4_net_table does not use designated initializers to easily fix this entry. The vulnerability was introduced when these sysctls were moved from the init-net ipv4_table to the per-net ipv4_net_table without realizing tcp_allowed_congestion_control was writable, thus creating a leak across namespaces. The fix implemented forces these sysctls to be read-only, preventing writes that would leak across namespaces. This approach aligns with the original intent of these sysctls, which is to read which congestion control algorithms are available or allowed, not to modify them. The vulnerability could allow a malicious user or container with write access to tcp_allowed_congestion_control in one namespace to affect the TCP congestion control behavior in other namespaces, potentially impacting network performance or behavior across isolated environments. No known exploits in the wild have been reported, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily in environments that use Linux containers or virtualized network namespaces extensively, such as cloud service providers, data centers, and enterprises deploying microservices architectures. The ability to write to tcp_allowed_congestion_control globally from a single namespace could allow an attacker with limited privileges in one container or namespace to influence TCP congestion control algorithms in other containers or namespaces. This could degrade network performance, cause denial of service conditions, or disrupt network traffic management policies. While it does not directly lead to privilege escalation or data leakage, the impact on network reliability and isolation can be significant, especially in multi-tenant environments common in European cloud infrastructures. Organizations relying on strict network namespace isolation for security and performance guarantees may find this vulnerability undermines those guarantees. Additionally, critical infrastructure operators using Linux-based systems with network namespaces could experience network instability or unexpected behavior, affecting service availability.

European organizations should ensure that their Linux kernel versions are updated to include the patch that makes tcp_allowed_congestion_control read-only in non-init network namespaces. Since the vulnerability stems from writable global state leaking across namespaces, applying the upstream kernel fix or vendor-provided patches is the most effective mitigation. Administrators should audit their container and virtualization environments to identify any use of tcp_allowed_congestion_control sysctl writes and restrict such operations to trusted users only. Network namespace isolation policies should be reviewed and enforced to prevent unauthorized modifications. For environments where kernel updates are delayed, consider implementing compensating controls such as limiting container capabilities (e.g., dropping CAP_NET_ADMIN) to prevent sysctl modifications. Monitoring network performance and congestion control behavior anomalies can help detect exploitation attempts. Finally, coordinate with Linux distribution vendors and cloud providers to ensure timely patch deployment and validation in production environments.