CVE-2026-45905

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel XFRM ICMP Route Lookup

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM (IPsec) policies. The lookup sequence is: 1. First, lookup output route for ICMP reply (dst = original src) 2. Pass through xfrm_lookup() for policy check 3. If blocked (-EPERM) or dst is not local, enter "reverse path" 4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec which reverses the original packet's flow (saddr<->daddr swapped) 5. If fl4_dec.saddr is local (we are the original destination), use __ip_route_output_key() for output route lookup 6. If fl4_dec.saddr is NOT local (we are a forwarding node), use ip_route_input() to simulate the reverse packet's input path 7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag The bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr (original packet's source) as destination. If this address becomes local between the initial check and ip_route_input() call (e.g., due to concurrent "ip addr add"), ip_route_input() returns a LOCAL route with dst.output set to ip_rt_bug. This route is then used for ICMP output, causing dst_output() to call ip_rt_bug(), triggering a WARN_ON: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1 Call Trace: <TASK> ip_push_pending_frames+0x202/0x240 icmp_push_reply+0x30d/0x430 __icmp_send+0x1149/0x24f0 ip_options_compile+0xa2/0xd0 ip_rcv_finish_core+0x829/0x1950 ip_rcv+0x2d7/0x420 __netif_receive_skb_one_core+0x185/0x1f0 netif_receive_skb+0x90/0x450 tun_get_user+0x3413/0x3fb0 tun_chr_write_iter+0xe4/0x220 ... Fix this by checking rt2->rt_type after ip_route_input(). If it's RTN_LOCAL, the route cannot be used for output, so treat it as an error. The reproducer requires kernel modification to widen the race window, making it unsuitable as a selftest. It is available at: https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-27

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-25

NVD

CVE-2026-45905

EUVD

EUVD-2026-32371

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.128 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)
linux	linux_kernel	From 2.6.25 (inc) to 6.1.165 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's handling of ICMP error message routing, specifically in the function icmp_route_lookup(). The function performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for IPsec (XFRM) policies.

The bug occurs during a 'reverse path' lookup step where the kernel simulates the reverse packet's input path using ip_route_input(). If the destination address becomes local between the initial check and this call (due to concurrent network configuration changes), ip_route_input() returns a LOCAL route with a problematic output handler (ip_rt_bug). This causes the kernel to call ip_rt_bug(), triggering a warning and potential instability.

The fix involves checking the route type after ip_route_input() and treating LOCAL routes as errors for output, preventing the use of the problematic route.

Detection Guidance

This vulnerability manifests as a kernel warning triggered by the ip_rt_bug function, which results in a WARN_ON message in the kernel logs.

To detect this vulnerability on your system, you should monitor your kernel logs for warnings related to ip_rt_bug or route.c at around line 1275.

Suggested commands to detect signs of this vulnerability include:

Use dmesg or journalctl to check kernel logs for warnings: dmesg | grep ip_rt_bug
journalctl -k | grep ip_rt_bug
Look for WARN_ON messages related to routing or ICMP errors in the kernel logs.

Impact Analysis

This vulnerability can cause the Linux kernel to trigger a warning and potentially unstable behavior when handling ICMP error messages under certain race conditions involving network address changes.

Specifically, it may lead to kernel warnings (WARN_ON) and could affect network packet processing reliability, possibly causing disruptions in network communication or kernel instability.

Mitigation Strategies

The vulnerability is fixed by a kernel patch that checks the route type after ip_route_input() and treats RTN_LOCAL routes as errors to prevent the ip_rt_bug warning.

Immediate mitigation steps include:

Update your Linux kernel to a version that includes the fix for this vulnerability.
Avoid concurrent changes to IP addresses (such as adding IP addresses) that could trigger the race condition until the kernel is updated.
Monitor kernel logs for ip_rt_bug warnings to detect if the issue is occurring.

Hi! I’m here to help you understand CVE-2026-45905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70