PT-2026-61231 · Linux · Linux
CVE-2026-63914
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.3
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L |
In the Linux kernel, the following vulnerability has been resolved:
xfrm: route MIGRATE notifications to caller's netns
xfrm send migrate() in net/xfrm/xfrm user.c and pfkey send migrate()
in net/key/af key.c both hardcode &init net for the multicast that
announces a successful XFRM MSG MIGRATE / SADB X MIGRATE.
XFRM MSG MIGRATE arrives on a per-netns NETLINK XFRM socket, and the
rest of the xfrm/af key netlink path was made netns-aware in 2008.
The other 14 multicast paths in xfrm user.c route their event using
xs net(x), xp net(xp) or sock net(skb->sk); only the migrate path
was missed.
Two consequences of the init net hardcoding:
-
The notification (selector, old/new endpoint addresses, and the km address) is delivered to listeners on init net's XFRMNLGRP MIGRATE / pfkey BROADCAST ALL groups rather than on the issuing netns. An IKE daemon running in init net therefore receives migration notifications originating from any other netns on the host.
-
An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken.
Thread struct net through km migrate() and the xfrm mgr.migrate
function pointer, drop the &init net override in xfrm send migrate()
and pfkey send migrate(), and pass the caller's net (already in
scope in xfrm migrate() via sock net(skb->sk)) all the way down.
struct xfrm mgr is in-tree only and not exported as a stable API,
so the function-pointer signature change is internal.
pfkey broadcast() is already netns-aware via net generic(net,
pfkey net id) since the pernet conversion. The five other
pfkey broadcast() callers in af key.c already pass xs net(x),
sock net(sk) or a per-netns net, so this only removes the
&init net outlier.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux