FKIE_CVE-2026-68294

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-19 17:20
Severity
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in. As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide. QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code).
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7814f6a3415cad38aa8d6dfc573df778260d66aa",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "2d22b94a154ccb9755dddfff802fe3e2b1adbab5",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "4b95e1f0d6e6342c427cb341ee18a894b146b789",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "f488116df769bdaf89c93371350e49e12133e70f",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "8150c48fb978e01689f94ed80148f8a7499ae571",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "659b9b4f194bb56b9903cc95e786ef1d438baa7d",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "3b536db8fb32da9e9c62f2bb45e2e319331f0426",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: restrict socket creation to the initial network namespace\n\nQRTR keeps its entire port and node state in module-global variables\nthat are not partitioned per network namespace: qrtr_local_nid is a\nsingle global node id (always 1) and qrtr_ports is a single global\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that\nglobal state with no network-namespace check, and qrtr_create() places\nno restriction on the namespace a socket is created in.\n\nAs a result an unprivileged process that creates an AF_QIPCRTR socket\nin a separate network namespace, e.g. via\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR\nsockets owned by another namespace, and vice versa. The receiving\nsocket sees such a message as coming from node id 1, indistinguishable\nfrom a legitimate local client, breaking the isolation that network\nnamespaces are expected to provide.\n\nQRTR is a transport to global hardware endpoints (the modem and other\nremote processors) and has no per-namespace semantics; its in-kernel\nname service already creates its socket in init_net only. Confine the\nsocket family to the initial network namespace, as other\nnon-namespace-aware socket families do (see llc_ui_create() and the\nieee802154 socket code)."
    }
  ],
  "id": "CVE-2026-68294",
  "lastModified": "2026-08-19T17:20:40.730",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-10T13:20:18.820",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.