{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68294", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.380Z", "datePublished": "2026-08-10T12:02:27.423Z", "dateUpdated": "2026-08-19T16:32:43.629Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:32:43.629Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: restrict socket creation to the initial network namespace\n\nQRTR keeps its entire port and node state in module-global variables\nthat are not partitioned per network namespace: qrtr_local_nid is a\nsingle global node id (always 1) and qrtr_ports is a single global\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that\nglobal state with no network-namespace check, and qrtr_create() places\nno restriction on the namespace a socket is created in.\n\nAs a result an unprivileged process that creates an AF_QIPCRTR socket\nin a separate network namespace, e.g. via\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR\nsockets owned by another namespace, and vice versa. The receiving\nsocket sees such a message as coming from node id 1, indistinguishable\nfrom a legitimate local client, breaking the isolation that network\nnamespaces are expected to provide.\n\nQRTR is a transport to global hardware endpoints (the modem and other\nremote processors) and has no per-namespace semantics; its in-kernel\nname service already creates its socket in init_net only. Confine the\nsocket family to the initial network namespace, as other\nnon-namespace-aware socket families do (see llc_ui_create() and the\nieee802154 socket code)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to issue socket()/sendmsg() syscalls on an AF_QIPCRTR socket from within a network namespace on the target system; there is no remote packet path into qrtr_create().\nAC:L - The attack is fully deterministic: unshare(CLONE_NEWUSER|CLONE_NEWNET), create an AF_QIPCRTR socket (module autoloads via net-pf-42), and sendmsg() to node 1. No race, no memory-layout dependency, no victim state required.\nPR:L - Any unprivileged local user can create the required network namespace via unshare(CLONE_NEWUSER|CLONE_NEWNET), and a containerized process is already in one; the CAP_NET_ADMIN check at qrtr_port_assign() only gates low/control ports and is not needed for this attack.\nUI:N - The attacker performs all steps itself; no action by any other user or administrator is required to trigger the cross-namespace delivery.\nS:C - The flaw defeats the network-namespace confinement boundary itself: a process sandboxed in its own netns reaches the init_net global QRTR control plane, the in-kernel name service, and host-owned sockets, impacting resources under a different security authority than the attacker's container.\nC:H - By spoofing QRTR_TYPE_NEW_SERVER to the name service, a confined attacker registers itself as a well-known service so legitimate host clients direct their QMI traffic to it, and it can address modem/remote-processor endpoints directly, exposing sensitive telephony data it was isolated from.\nI:H - The attacker can inject arbitrary control-plane messages (NEW_SERVER, DEL_SERVER, BYE, DEL_CLIENT) that the receiver cannot distinguish from a legitimate node-1 client, corrupting the global service registry and allowing forged replies to host clients and commands to the modem.\nA:H - A single spoofed QRTR_TYPE_BYE makes ctrl_cmd_bye() delete every server registered on the local node and broadcast their removal, and the QRTR_NS_MAX_SERVERS/MAX_LOOKUPS limits can be exhausted, causing complete and repeatable loss of QRTR/modem IPC service for the whole system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/qrtr/af_qrtr.c" ], "versions": [ { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "7814f6a3415cad38aa8d6dfc573df778260d66aa", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "2d22b94a154ccb9755dddfff802fe3e2b1adbab5", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "4b95e1f0d6e6342c427cb341ee18a894b146b789", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "f488116df769bdaf89c93371350e49e12133e70f", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "8150c48fb978e01689f94ed80148f8a7499ae571", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "659b9b4f194bb56b9903cc95e786ef1d438baa7d", "status": "affected", "versionType": "git" }, { "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881", "lessThan": "3b536db8fb32da9e9c62f2bb45e2e319331f0426", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/qrtr/af_qrtr.c" ], "versions": [ { "version": "4.7", "status": "affected" }, { "version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa" }, { "url": "https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5" }, { "url": "https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb" }, { "url": "https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789" }, { "url": "https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f" }, { "url": "https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571" }, { "url": "https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d" }, { "url": "https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426" } ], "title": "net: qrtr: restrict socket creation to the initial network namespace", "x_generator": { "engine": "bippy-1.2.0" } } } }