CVE-2026-45905

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

icmp_route_lookup() performs multiple route lookups to find a suitable

route for sending ICMP error messages, with special handling for XFRM

(IPsec) policies.

The lookup sequence is:

1. First, lookup output route for ICMP reply (dst = original src)

2. Pass through xfrm_lookup() for policy check

3. If blocked (-EPERM) or dst is not local, enter "reverse path"

4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec

which reverses the original packet's flow (saddr<->daddr swapped)

5. If fl4_dec.saddr is local (we are the original destination), use

__ip_route_output_key() for output route lookup

6. If fl4_dec.saddr is NOT local (we are a forwarding node), use

ip_route_input() to simulate the reverse packet's input path

7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag

The bug occurs in step 6: ip_route_input() is calle

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References