CVE-2026-68294

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: restrict socket creation to the initial network namespace

QRTR keeps its entire port and node state in module-global variables

that are not partitioned per network namespace: qrtr_local_nid is a

single global node id (always 1) and qrtr_ports is a single global

xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that

global state with no network-namespace check, and qrtr_create() places

no restriction on the namespace a socket is created in.

As a result an unprivileged process that creates an AF_QIPCRTR socket

in a separate network namespace, e.g. via

unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -

including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR

sockets owned by another namespace, and vice versa. The receiving

socket sees such a message as coming from node id 1, indistinguishable

from a legitimate local client, breaking the isolation that network

namespa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References