GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-90110 (GCVE-0-2026-90110)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
inetpeer: randomize RB-tree node comparison using SipHash
Summary
In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b145425f269a17ed344d737f746b844dfac60c82 , < b20e98f0bb668a59abaf7bcf85d75c073e90d352 (git)
Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 5f127e3cc9647a8a70db12c65dbd0de473545380 (git)
Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 199fcf285e498111e029137d088949bc6c26d578 (git)
Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 857681f6835d5b0a7bc4a34a026baeaaf5215623 (git)
Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 7109bb63667a53e4542ad845476f97d0c8b28a61 (git)
Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 2ee66e9487172fcd189bc52a767c30dad7141c09 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b20e98f0bb668a59abaf7bcf85d75c073e90d352",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "5f127e3cc9647a8a70db12c65dbd0de473545380",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "199fcf285e498111e029137d088949bc6c26d578",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "857681f6835d5b0a7bc4a34a026baeaaf5215623",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "7109bb63667a53e4542ad845476f97d0c8b28a61",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "2ee66e9487172fcd189bc52a767c30dad7141c09",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninetpeer: randomize RB-tree node comparison using SipHash\n\nThe inetpeer rate limiting system stores peer entries in a Red-Black tree\nkeyed deterministically on the remote IP address. Because tree lookups walk\nthe RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),\nan off-path adversary can predict the exact topology of the tree and the\nsequence of nodes traversed during lookups (the gc_stack candidate list).\n\nBy combining deterministic tree traversal with aggressive garbage collection\n(triggered when tree size exceeds inet_peer_threshold), an attacker can\nselectively force the eviction of targeted inet_peer nodes. When an evicted\nnode is subsequently re-created upon receiving a new packet, its rate-limiting\ntoken bucket (rate_tokens, rate_last) is reset to full capacity. This creates\na side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP\nrate limits and infer open UDP ports (similar to SAD DNS style attacks).\n\nMitigate this by randomizing the RB-tree node comparison logic using SipHash\nwith a secret key (inetpeer_hash_key) initialized via net_get_random_once().\nNodes are ordered in the tree by SipHash(addr, key) rather than raw IP\naddresses. Because the secret key is unknown to external entities, the tree\nlayout and lookup traversal paths are unpredictable to off-path adversaries,\nbreaking the deterministic eviction gadget.\n\nCache the computed 64-bit SipHash (hash) in struct inet_peer and compute the\ntarget hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing\nSipHash at every step of the RB-tree walk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A received IPv4 UDP datagram to a closed port takes ip_rcv \u2192 ip_local_deliver \u2192 udp_rcv() \u2192 icmp_send() \u2192 icmpv4_xrlim_allow() \u2192 inet_getpeer_v4(), with icmp_route_lookup() setting fl4-\u003edaddr from iph-\u003esaddr; ip4_frag_init() also keys inet_getpeer_v4() on the fragment source. Those attacker-chosen addresses are the inetpeer RB-tree keys on a routable IP path.\nAC:L - The attacker chooses the source addresses inetpeer_addr_cmp() orders, grows base-\u003etotal past inet_peer_threshold via inet_getpeer() on those UDP/ICMP or fragment lookups, then looks up further keys so lookup() pushes the victim inet_peer onto gc_stack and inet_peer_gc() evicts it (ttl=0, refcount_dec_if_one). Tree shape and eviction set are functions of those keys, not uninfluenced victim state.\nPR:N - udp_rcv() emits ICMP_PORT_UNREACH and icmpv4_xrlim_allow() calls inet_getpeer_v4() for any inbound IPv4/UDP packet with no socket, credential, or capability check; ip4_frag_init() likewise creates peers from unauthenticated fragment sources.\nUI:N - Peer insertion in inet_getpeer(), gc_stack collection in lookup(), and the rate_tokens/rate_last reset when a GC\u0027d inet_peer is kmem_cache_alloc\u0027d again all run in the receive/softirq path of the attacker\u0027s own packets; no local user must mount, open, or otherwise act.\nS:U - The inet_peer RB-tree and ICMP token bucket live in the host IPv4/IPv6 stack; any recovered UDP port or poisoned resolver cache remains that host\u0027s network-stack authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Evicting a chosen node via lookup()\u0027s gc_stack and recreating it in inet_getpeer() sets rate_tokens=0 and rate_last=jiffies-60*HZ so inet_peer_xrlim_allow() starts at full burst, resetting the per-IP ICMP oracle and letting an off-path attacker infer open/ephemeral UDP ports (SAD DNS), defeating source-port randomization.\nI:H - Recovering the ephemeral UDP source port of an in-flight DNS query through that reset inet_peer_xrlim_allow() oracle lets the same off-path attacker spoof the nameserver reply, win the race against the legitimate response, and poison the resolver cache, arbitrarily redirecting later lookups.\nA:L - Repeated inet_peer_gc() eviction and inet_getpeer() recreate of rate_tokens lets the attacker keep passing inet_peer_xrlim_allow() and drain icmp_global_credit, suppressing ICMP errors (port unreachable, time exceeded) to other peers; lookup() and inet_peer_gc() do not oops, so the loss is ICMP signalling degradation rather than a crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:04.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b20e98f0bb668a59abaf7bcf85d75c073e90d352"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f127e3cc9647a8a70db12c65dbd0de473545380"
        },
        {
          "url": "https://git.kernel.org/stable/c/199fcf285e498111e029137d088949bc6c26d578"
        },
        {
          "url": "https://git.kernel.org/stable/c/857681f6835d5b0a7bc4a34a026baeaaf5215623"
        },
        {
          "url": "https://git.kernel.org/stable/c/7109bb63667a53e4542ad845476f97d0c8b28a61"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee66e9487172fcd189bc52a767c30dad7141c09"
        }
      ],
      "title": "inetpeer: randomize RB-tree node comparison using SipHash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90110",
    "datePublished": "2026-09-17T16:06:18.113Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-09-18T17:53:04.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90110",
      "date": "2026-09-18",
      "epss": "0.00216",
      "percentile": "0.12312"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/inetpeer.h",
                  "net/ipv4/inetpeer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b20e98f0bb668a59abaf7bcf85d75c073e90d352",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5f127e3cc9647a8a70db12c65dbd0de473545380",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "199fcf285e498111e029137d088949bc6c26d578",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "857681f6835d5b0a7bc4a34a026baeaaf5215623",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7109bb63667a53e4542ad845476f97d0c8b28a61",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ee66e9487172fcd189bc52a767c30dad7141c09",
                    "status": "affected",
                    "version": "b145425f269a17ed344d737f746b844dfac60c82",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/inetpeer.h",
                  "net/ipv4/inetpeer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.14"
                  },
                  {
                    "lessThan": "4.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninetpeer: randomize RB-tree node comparison using SipHash\n\nThe inetpeer rate limiting system stores peer entries in a Red-Black tree\nkeyed deterministically on the remote IP address. Because tree lookups walk\nthe RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),\nan off-path adversary can predict the exact topology of the tree and the\nsequence of nodes traversed during lookups (the gc_stack candidate list).\n\nBy combining deterministic tree traversal with aggressive garbage collection\n(triggered when tree size exceeds inet_peer_threshold), an attacker can\nselectively force the eviction of targeted inet_peer nodes. When an evicted\nnode is subsequently re-created upon receiving a new packet, its rate-limiting\ntoken bucket (rate_tokens, rate_last) is reset to full capacity. This creates\na side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP\nrate limits and infer open UDP ports (similar to SAD DNS style attacks).\n\nMitigate this by randomizing the RB-tree node comparison logic using SipHash\nwith a secret key (inetpeer_hash_key) initialized via net_get_random_once().\nNodes are ordered in the tree by SipHash(addr, key) rather than raw IP\naddresses. Because the secret key is unknown to external entities, the tree\nlayout and lookup traversal paths are unpredictable to off-path adversaries,\nbreaking the deterministic eviction gadget.\n\nCache the computed 64-bit SipHash (hash) in struct inet_peer and compute the\ntarget hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing\nSipHash at every step of the RB-tree walk."
          }
        ],
        "id": "CVE-2026-90110",
        "lastModified": "2026-09-18T18:17:42.327",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:02.990",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/199fcf285e498111e029137d088949bc6c26d578"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2ee66e9487172fcd189bc52a767c30dad7141c09"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f127e3cc9647a8a70db12c65dbd0de473545380"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7109bb63667a53e4542ad845476f97d0c8b28a61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/857681f6835d5b0a7bc4a34a026baeaaf5215623"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b20e98f0bb668a59abaf7bcf85d75c073e90d352"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-18T00:21:20Z",
      "cve": "CVE-2026-90110",
      "id": "CVE-2026-90110",
      "initial_release_date": "2026-09-18T00:21:20Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90110",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90110.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.