Netlink is the Linux communication channel between userspace programs and the kernel, used for networking, routing, and many system-control tasks. It lets tools and daemons send structured messages to kernel subsystems and receive status or event notifications back. In practice, Netlink is how software asks the kernel to create interfaces, configure forwarding, or manage packet-processing features such as Open vSwitch.
It matters in cyber security because Netlink sits at a trust boundary: data sent from a user process can reach privileged kernel code. If the kernel parser mishandles attributes, lengths, or nested messages, malformed input may trigger crashes or memory corruption, creating a path to privilege escalation. Attackers often look for these bugs in local attack chains, especially when user namespaces or capabilities like CAP_NET_ADMIN make the reachable surface larger. Defenders reduce risk by limiting who can access networking controls, hardening namespace policy, and keeping kernel networking components fully patched.