CVE-2026-68294 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: restrict socket creation to the initial network namespace
QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in.
As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide.
QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a critical network namespace isolation bypass in the Linux kernel's QRTR (Qualcomm Remote Processor) subsystem. This issue stems from the improper handling of global variables within the kernel module that manages communication with remote processors such as modems and other hardware endpoints. The QRTR protocol implementation maintains its port and node state in module-global variables rather than partitioning them per network namespace, creating a fundamental architectural flaw that undermines the security boundaries provided by Linux network namespaces.
The technical flaw manifests through the use of global variables that are shared across all network namespaces without proper isolation mechanisms. Specifically, qrtr_local_nid remains as a single global node id set to 1, while qrtr_ports maintains a global xarray containing all port information. The functions qrtr_port_lookup() and qrtr_local_enqueue() operate on these global data structures without performing any network namespace validation checks. Additionally, the qrtr_create() function permits socket creation in any network namespace, completely bypassing the expected isolation mechanisms that should prevent cross-namespace communication.
This vulnerability enables an unprivileged process to exploit network namespace separation by creating AF_QIPCRTR sockets within separate network namespaces using mechanisms like unshare(CLONE_NEWUSER | CLONE_NEWNET). Once established, these sockets can send QRTR datagrams including critical control-plane messages such as QRTR_TYPE_NEW_SERVER to sockets owned by different network namespaces. The receiving socket processes these messages as if they originated from node id 1, effectively making them appear as legitimate local clients. This behavior completely breaks the expected network namespace isolation, allowing potential attackers to manipulate or gain information about other network namespaces through carefully crafted malicious communications.
The operational impact of this vulnerability is significant as it represents a privilege escalation vector that undermines fundamental Linux security boundaries. An attacker can leverage this flaw to perform cross-namespace communication that should be impossible, potentially leading to information disclosure, denial of service, or even more sophisticated attacks that exploit the interplay between different network namespace states. The attack surface is particularly concerning given that QRTR serves as a transport protocol for global hardware endpoints, making it a critical component in system security.
The fix addresses this issue by restricting QRTR socket creation to the initial network namespace, following established patterns used by other non-namespace-aware socket families within the Linux kernel. This approach aligns with security practices demonstrated in implementations like llc_ui_create() and ieee802154 socket code, which properly confine their functionality to init_net only. This restriction ensures that QRTR's in-kernel name service remains isolated as intended, since it already operates exclusively within the initial network namespace. The solution follows the principle of least privilege by preventing unauthorized access to hardware communication endpoints from non-initial namespaces.
This vulnerability maps directly to CWE-693 Protection Mechanism Failure and aligns with ATT&CK technique T1068, which covers Local Privilege Escalation through improper access control mechanisms. The fix implements proper namespace isolation that prevents unauthorized cross-namespace communication, thereby strengthening the kernel's security posture against privilege escalation attacks that rely on breaking network namespace boundaries. This remediation ensures that the kernel maintains its expected security model where network namespaces properly isolate processes and their communications from one another.