CVE-2026-68294net: qrtr: restrict socket creation to the initial network namespace
- 8.8HighCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in. As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide. QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code).
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 7814f6a3415cad38aa8d6dfc573df778260d66aa
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 2d22b94a154ccb9755dddfff802fe3e2b1adbab5
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 4b95e1f0d6e6342c427cb341ee18a894b146b789
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < f488116df769bdaf89c93371350e49e12133e70f
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 8150c48fb978e01689f94ed80148f8a7499ae571
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 659b9b4f194bb56b9903cc95e786ef1d438baa7d
- affected bdabad3e363d825ddf9679dd431cca0b2c30f881 – < 3b536db8fb32da9e9c62f2bb45e2e319331f0426
- affected 4.7
- unaffected < 4.7
- unaffected 5.10.265 – ≤ 5.10.*
- unaffected 5.15.216 – ≤ 5.15.*
- unaffected 6.1.183 – ≤ 6.1.*
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa (opens in a new tab)
- https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5 (opens in a new tab)
- https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb (opens in a new tab)
- https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789 (opens in a new tab)
- https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f (opens in a new tab)
- https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571 (opens in a new tab)
- https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d (opens in a new tab)
- https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55395 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68294)Record last updated .