GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-45905 (GCVE-0-2026-45905)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:17 – Updated: 2026-05-27 12:17
VLAI
Title
xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM (IPsec) policies. The lookup sequence is: 1. First, lookup output route for ICMP reply (dst = original src) 2. Pass through xfrm_lookup() for policy check 3. If blocked (-EPERM) or dst is not local, enter "reverse path" 4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec which reverses the original packet's flow (saddr<->daddr swapped) 5. If fl4_dec.saddr is local (we are the original destination), use __ip_route_output_key() for output route lookup 6. If fl4_dec.saddr is NOT local (we are a forwarding node), use ip_route_input() to simulate the reverse packet's input path 7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag The bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr (original packet's source) as destination. If this address becomes local between the initial check and ip_route_input() call (e.g., due to concurrent "ip addr add"), ip_route_input() returns a LOCAL route with dst.output set to ip_rt_bug. This route is then used for ICMP output, causing dst_output() to call ip_rt_bug(), triggering a WARN_ON: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1 Call Trace: <TASK> ip_push_pending_frames+0x202/0x240 icmp_push_reply+0x30d/0x430 __icmp_send+0x1149/0x24f0 ip_options_compile+0xa2/0xd0 ip_rcv_finish_core+0x829/0x1950 ip_rcv+0x2d7/0x420 __netif_receive_skb_one_core+0x185/0x1f0 netif_receive_skb+0x90/0x450 tun_get_user+0x3413/0x3fb0 tun_chr_write_iter+0xe4/0x220 ... Fix this by checking rt2->rt_type after ip_route_input(). If it's RTN_LOCAL, the route cannot be used for output, so treat it as an error. The reproducer requires kernel modification to widen the race window, making it unsuitable as a selftest. It is available at: https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < 9a95ec9144eeff1fc6fbcc21b677e322c6f1430b (git)
Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < 2c1f59005da9dd4b07b26984fd719e36557dc57c (git)
Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < b04061f89ffc6168e7ec3c71d0086ec3c3797228 (git)
Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < 1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1 (git)
Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < 423ce12d10b426709489d6b84fdaa6d2f31c5652 (git)
Affected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 , < 81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.25
Unaffected: 0 , < 2.6.25 (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a95ec9144eeff1fc6fbcc21b677e322c6f1430b",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            },
            {
              "lessThan": "2c1f59005da9dd4b07b26984fd719e36557dc57c",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            },
            {
              "lessThan": "b04061f89ffc6168e7ec3c71d0086ec3c3797228",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            },
            {
              "lessThan": "1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            },
            {
              "lessThan": "423ce12d10b426709489d6b84fdaa6d2f31c5652",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            },
            {
              "lessThan": "81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00",
              "status": "affected",
              "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix ip_rt_bug race in icmp_route_lookup reverse path\n\nicmp_route_lookup() performs multiple route lookups to find a suitable\nroute for sending ICMP error messages, with special handling for XFRM\n(IPsec) policies.\n\nThe lookup sequence is:\n1. First, lookup output route for ICMP reply (dst = original src)\n2. Pass through xfrm_lookup() for policy check\n3. If blocked (-EPERM) or dst is not local, enter \"reverse path\"\n4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec\n   which reverses the original packet\u0027s flow (saddr\u003c-\u003edaddr swapped)\n5. If fl4_dec.saddr is local (we are the original destination), use\n   __ip_route_output_key() for output route lookup\n6. If fl4_dec.saddr is NOT local (we are a forwarding node), use\n   ip_route_input() to simulate the reverse packet\u0027s input path\n7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag\n\nThe bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr\n(original packet\u0027s source) as destination. If this address becomes local\nbetween the initial check and ip_route_input() call (e.g., due to\nconcurrent \"ip addr add\"), ip_route_input() returns a LOCAL route with\ndst.output set to ip_rt_bug.\n\nThis route is then used for ICMP output, causing dst_output() to call\nip_rt_bug(), triggering a WARN_ON:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1\n Call Trace:\n  \u003cTASK\u003e\n  ip_push_pending_frames+0x202/0x240\n  icmp_push_reply+0x30d/0x430\n  __icmp_send+0x1149/0x24f0\n  ip_options_compile+0xa2/0xd0\n  ip_rcv_finish_core+0x829/0x1950\n  ip_rcv+0x2d7/0x420\n  __netif_receive_skb_one_core+0x185/0x1f0\n  netif_receive_skb+0x90/0x450\n  tun_get_user+0x3413/0x3fb0\n  tun_chr_write_iter+0xe4/0x220\n  ...\n\nFix this by checking rt2-\u003ert_type after ip_route_input(). If it\u0027s\nRTN_LOCAL, the route cannot be used for output, so treat it as an error.\n\nThe reproducer requires kernel modification to widen the race window,\nmaking it unsuitable as a selftest. It is available at:\n\n  https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:15.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a95ec9144eeff1fc6fbcc21b677e322c6f1430b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c1f59005da9dd4b07b26984fd719e36557dc57c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04061f89ffc6168e7ec3c71d0086ec3c3797228"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/423ce12d10b426709489d6b84fdaa6d2f31c5652"
        },
        {
          "url": "https://git.kernel.org/stable/c/81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00"
        }
      ],
      "title": "xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45905",
    "datePublished": "2026-05-27T12:17:15.050Z",
    "dateReserved": "2026-05-13T15:03:33.084Z",
    "dateUpdated": "2026-05-27T12:17:15.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45905",
      "date": "2026-09-17",
      "epss": "0.00111",
      "percentile": "0.01529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45905\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:04.993\",\"lastModified\":\"2026-06-24T16:28:18.513\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfrm: fix ip_rt_bug race in icmp_route_lookup reverse path\\n\\nicmp_route_lookup() performs multiple route lookups to find a suitable\\nroute for sending ICMP error messages, with special handling for XFRM\\n(IPsec) policies.\\n\\nThe lookup sequence is:\\n1. First, lookup output route for ICMP reply (dst = original src)\\n2. Pass through xfrm_lookup() for policy check\\n3. If blocked (-EPERM) or dst is not local, enter \\\"reverse path\\\"\\n4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec\\n   which reverses the original packet\u0027s flow (saddr\u003c-\u003edaddr swapped)\\n5. If fl4_dec.saddr is local (we are the original destination), use\\n   __ip_route_output_key() for output route lookup\\n6. If fl4_dec.saddr is NOT local (we are a forwarding node), use\\n   ip_route_input() to simulate the reverse packet\u0027s input path\\n7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag\\n\\nThe bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr\\n(original packet\u0027s source) as destination. If this address becomes local\\nbetween the initial check and ip_route_input() call (e.g., due to\\nconcurrent \\\"ip addr add\\\"), ip_route_input() returns a LOCAL route with\\ndst.output set to ip_rt_bug.\\n\\nThis route is then used for ICMP output, causing dst_output() to call\\nip_rt_bug(), triggering a WARN_ON:\\n\\n ------------[ cut here ]------------\\n WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1\\n Call Trace:\\n  \u003cTASK\u003e\\n  ip_push_pending_frames+0x202/0x240\\n  icmp_push_reply+0x30d/0x430\\n  __icmp_send+0x1149/0x24f0\\n  ip_options_compile+0xa2/0xd0\\n  ip_rcv_finish_core+0x829/0x1950\\n  ip_rcv+0x2d7/0x420\\n  __netif_receive_skb_one_core+0x185/0x1f0\\n  netif_receive_skb+0x90/0x450\\n  tun_get_user+0x3413/0x3fb0\\n  tun_chr_write_iter+0xe4/0x220\\n  ...\\n\\nFix this by checking rt2-\u003ert_type after ip_route_input(). If it\u0027s\\nRTN_LOCAL, the route cannot be used for output, so treat it as an error.\\n\\nThe reproducer requires kernel modification to widen the race window,\\nmaking it unsuitable as a selftest. It is available at:\\n\\n  https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/icmp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"9a95ec9144eeff1fc6fbcc21b677e322c6f1430b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"2c1f59005da9dd4b07b26984fd719e36557dc57c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"b04061f89ffc6168e7ec3c71d0086ec3c3797228\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"423ce12d10b426709489d6b84fdaa6d2f31c5652\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7817f3a959ed99d7443afc12f78a7e1fcc2063\",\"lessThan\":\"81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/icmp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.25\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.25\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.165\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.25\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"61A94D48-D137-4E5A-BF27-2CDF9E30723C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"BF463CB7-1F58-4607-B847-77ED23E4B9B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c1f59005da9dd4b07b26984fd719e36557dc57c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/423ce12d10b426709489d6b84fdaa6d2f31c5652\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a95ec9144eeff1fc6fbcc21b677e322c6f1430b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b04061f89ffc6168e7ec3c71d0086ec3c3797228\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-27T16:19:44+00:00",
      "cve": "CVE-2026-45905",
      "id": "CVE-2026-45905",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45905.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:14:21Z",
      "cve": "CVE-2026-45905",
      "id": "CVE-2026-45905",
      "initial_release_date": "2026-05-28T03:56:28Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "678",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45905",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45905.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.