Cloudanix VulnDB

CVE-2026-68294

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug lets programs running inside isolated network containers talk directly to hardware components that should only be reachable from the main system, weakening the separation between those environments.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Authorization Bypass
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits AF_QIPCRTR socket creation in non-initial network namespaces, allowing unprivileged processes to send QRTR datagrams (including control messages like QRTR_TYPE_NEW_SERVER) across namespace boundaries using global module state (qrtr_local_nid and qrtr_ports) with no namespace checks, so messages appear to originate from node id 1.

Why it matters to the business

Breaks network namespace isolation on systems using QRTR for modem or remote processor communication, enabling cross-container or cross-VM leakage or unauthorized control-plane interaction that can undermine multi-tenant security boundaries.

How an attack unfolds

An attacker with unprivileged access invokes unshare(CLONE_NEWUSER | CLONE_NEWNET) to create a separate namespace, opens an AF_QIPCRTR socket inside it, and transmits QRTR messages that reach sockets owned by other namespaces; the receiver treats the traffic as local because it arrives from the single global node id 1.

How to fix it

Apply a kernel patch that confines AF_QIPCRTR socket creation to the initial network namespace (matching the approach used by llc and ieee802154 families) and rebuild or upgrade to the fixed kernel release.

How to confirm the fix worked

Verify that attempts to create AF_QIPCRTR sockets inside non-init_net namespaces now fail with EAFNOSUPPORT or equivalent, and confirm the qrtr_create implementation enforces init_net checks in the running kernel source or binary.

Typical attack path

  1. Invoke unshare to create a new user and network namespace
  2. Create an AF_QIPCRTR socket within the isolated namespace
  3. Send QRTR datagrams or control messages targeting sockets in the initial namespace
  4. Observe or influence hardware endpoints or name-service state that should remain isolated

How to detect it

Inspect audit logs or eBPF traces for AF_QIPCRTR socket creation events originating from non-initial network namespaces; correlate with QRTR control-message activity that references the global node id from unexpected contexts.

What your security team should do

  • Prioritize kernel updates that enforce the init_net restriction for QRTR
  • Disable unprivileged namespace creation via kernel.unprivileged_userns_clone where QRTR hardware access is not required
  • Audit workloads that rely on network namespaces for isolation when QRTR endpoints are present

The record

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in. As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide. QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code).

Affected packages

Ecosystem Package Introduced Fixed