Vulnerability-Lookup

FKIE_CVE-2026-90110

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/199fcf285e498111e029137d088949bc6c26d578
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2ee66e9487172fcd189bc52a767c30dad7141c09
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5f127e3cc9647a8a70db12c65dbd0de473545380
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7109bb63667a53e4542ad845476f97d0c8b28a61
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/857681f6835d5b0a7bc4a34a026baeaaf5215623
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b20e98f0bb668a59abaf7bcf85d75c073e90d352

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b20e98f0bb668a59abaf7bcf85d75c073e90d352",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "5f127e3cc9647a8a70db12c65dbd0de473545380",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "199fcf285e498111e029137d088949bc6c26d578",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "857681f6835d5b0a7bc4a34a026baeaaf5215623",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "7109bb63667a53e4542ad845476f97d0c8b28a61",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "2ee66e9487172fcd189bc52a767c30dad7141c09",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninetpeer: randomize RB-tree node comparison using SipHash\n\nThe inetpeer rate limiting system stores peer entries in a Red-Black tree\nkeyed deterministically on the remote IP address. Because tree lookups walk\nthe RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),\nan off-path adversary can predict the exact topology of the tree and the\nsequence of nodes traversed during lookups (the gc_stack candidate list).\n\nBy combining deterministic tree traversal with aggressive garbage collection\n(triggered when tree size exceeds inet_peer_threshold), an attacker can\nselectively force the eviction of targeted inet_peer nodes. When an evicted\nnode is subsequently re-created upon receiving a new packet, its rate-limiting\ntoken bucket (rate_tokens, rate_last) is reset to full capacity. This creates\na side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP\nrate limits and infer open UDP ports (similar to SAD DNS style attacks).\n\nMitigate this by randomizing the RB-tree node comparison logic using SipHash\nwith a secret key (inetpeer_hash_key) initialized via net_get_random_once().\nNodes are ordered in the tree by SipHash(addr, key) rather than raw IP\naddresses. Because the secret key is unknown to external entities, the tree\nlayout and lookup traversal paths are unpredictable to off-path adversaries,\nbreaking the deterministic eviction gadget.\n\nCache the computed 64-bit SipHash (hash) in struct inet_peer and compute the\ntarget hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing\nSipHash at every step of the RB-tree walk."
    }
  ],
  "id": "CVE-2026-90110",
  "lastModified": "2026-09-17T17:17:02.990",
  "metrics": {},
  "published": "2026-09-17T17:17:02.990",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/199fcf285e498111e029137d088949bc6c26d578"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2ee66e9487172fcd189bc52a767c30dad7141c09"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5f127e3cc9647a8a70db12c65dbd0de473545380"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7109bb63667a53e4542ad845476f97d0c8b28a61"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/857681f6835d5b0a7bc4a34a026baeaaf5215623"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b20e98f0bb668a59abaf7bcf85d75c073e90d352"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90110 (GCVE-0-2026-90110)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53

Title

inetpeer: randomize RB-tree node comparison using SipHash

Summary

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/b20e98f0bb668a59a…
https://git.kernel.org/stable/c/5f127e3cc9647a8a7…
https://git.kernel.org/stable/c/199fcf285e498111e…
https://git.kernel.org/stable/c/857681f6835d5b0a7…
https://git.kernel.org/stable/c/7109bb63667a53e45…
https://git.kernel.org/stable/c/2ee66e9487172fcd1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b145425f269a17ed344d737f746b844dfac60c82 , < b20e98f0bb668a59abaf7bcf85d75c073e90d352 (git) Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 5f127e3cc9647a8a70db12c65dbd0de473545380 (git) Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 199fcf285e498111e029137d088949bc6c26d578 (git) Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 857681f6835d5b0a7bc4a34a026baeaaf5215623 (git) Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 7109bb63667a53e4542ad845476f97d0c8b28a61 (git) Affected: b145425f269a17ed344d737f746b844dfac60c82 , < 2ee66e9487172fcd189bc52a767c30dad7141c09 (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b20e98f0bb668a59abaf7bcf85d75c073e90d352",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "5f127e3cc9647a8a70db12c65dbd0de473545380",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "199fcf285e498111e029137d088949bc6c26d578",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "857681f6835d5b0a7bc4a34a026baeaaf5215623",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "7109bb63667a53e4542ad845476f97d0c8b28a61",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            },
            {
              "lessThan": "2ee66e9487172fcd189bc52a767c30dad7141c09",
              "status": "affected",
              "version": "b145425f269a17ed344d737f746b844dfac60c82",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/inetpeer.h",
            "net/ipv4/inetpeer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninetpeer: randomize RB-tree node comparison using SipHash\n\nThe inetpeer rate limiting system stores peer entries in a Red-Black tree\nkeyed deterministically on the remote IP address. Because tree lookups walk\nthe RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),\nan off-path adversary can predict the exact topology of the tree and the\nsequence of nodes traversed during lookups (the gc_stack candidate list).\n\nBy combining deterministic tree traversal with aggressive garbage collection\n(triggered when tree size exceeds inet_peer_threshold), an attacker can\nselectively force the eviction of targeted inet_peer nodes. When an evicted\nnode is subsequently re-created upon receiving a new packet, its rate-limiting\ntoken bucket (rate_tokens, rate_last) is reset to full capacity. This creates\na side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP\nrate limits and infer open UDP ports (similar to SAD DNS style attacks).\n\nMitigate this by randomizing the RB-tree node comparison logic using SipHash\nwith a secret key (inetpeer_hash_key) initialized via net_get_random_once().\nNodes are ordered in the tree by SipHash(addr, key) rather than raw IP\naddresses. Because the secret key is unknown to external entities, the tree\nlayout and lookup traversal paths are unpredictable to off-path adversaries,\nbreaking the deterministic eviction gadget.\n\nCache the computed 64-bit SipHash (hash) in struct inet_peer and compute the\ntarget hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing\nSipHash at every step of the RB-tree walk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A received IPv4 UDP datagram to a closed port takes ip_rcv \u2192 ip_local_deliver \u2192 udp_rcv() \u2192 icmp_send() \u2192 icmpv4_xrlim_allow() \u2192 inet_getpeer_v4(), with icmp_route_lookup() setting fl4-\u003edaddr from iph-\u003esaddr; ip4_frag_init() also keys inet_getpeer_v4() on the fragment source. Those attacker-chosen addresses are the inetpeer RB-tree keys on a routable IP path.\nAC:L - The attacker chooses the source addresses inetpeer_addr_cmp() orders, grows base-\u003etotal past inet_peer_threshold via inet_getpeer() on those UDP/ICMP or fragment lookups, then looks up further keys so lookup() pushes the victim inet_peer onto gc_stack and inet_peer_gc() evicts it (ttl=0, refcount_dec_if_one). Tree shape and eviction set are functions of those keys, not uninfluenced victim state.\nPR:N - udp_rcv() emits ICMP_PORT_UNREACH and icmpv4_xrlim_allow() calls inet_getpeer_v4() for any inbound IPv4/UDP packet with no socket, credential, or capability check; ip4_frag_init() likewise creates peers from unauthenticated fragment sources.\nUI:N - Peer insertion in inet_getpeer(), gc_stack collection in lookup(), and the rate_tokens/rate_last reset when a GC\u0027d inet_peer is kmem_cache_alloc\u0027d again all run in the receive/softirq path of the attacker\u0027s own packets; no local user must mount, open, or otherwise act.\nS:U - The inet_peer RB-tree and ICMP token bucket live in the host IPv4/IPv6 stack; any recovered UDP port or poisoned resolver cache remains that host\u0027s network-stack authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Evicting a chosen node via lookup()\u0027s gc_stack and recreating it in inet_getpeer() sets rate_tokens=0 and rate_last=jiffies-60*HZ so inet_peer_xrlim_allow() starts at full burst, resetting the per-IP ICMP oracle and letting an off-path attacker infer open/ephemeral UDP ports (SAD DNS), defeating source-port randomization.\nI:H - Recovering the ephemeral UDP source port of an in-flight DNS query through that reset inet_peer_xrlim_allow() oracle lets the same off-path attacker spoof the nameserver reply, win the race against the legitimate response, and poison the resolver cache, arbitrarily redirecting later lookups.\nA:L - Repeated inet_peer_gc() eviction and inet_getpeer() recreate of rate_tokens lets the attacker keep passing inet_peer_xrlim_allow() and drain icmp_global_credit, suppressing ICMP errors (port unreachable, time exceeded) to other peers; lookup() and inet_peer_gc() do not oops, so the loss is ICMP signalling degradation rather than a crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:04.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b20e98f0bb668a59abaf7bcf85d75c073e90d352"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f127e3cc9647a8a70db12c65dbd0de473545380"
        },
        {
          "url": "https://git.kernel.org/stable/c/199fcf285e498111e029137d088949bc6c26d578"
        },
        {
          "url": "https://git.kernel.org/stable/c/857681f6835d5b0a7bc4a34a026baeaaf5215623"
        },
        {
          "url": "https://git.kernel.org/stable/c/7109bb63667a53e4542ad845476f97d0c8b28a61"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee66e9487172fcd189bc52a767c30dad7141c09"
        }
      ],
      "title": "inetpeer: randomize RB-tree node comparison using SipHash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90110",
    "datePublished": "2026-09-17T16:06:18.113Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-09-18T17:53:04.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.