CVE-2026-90110 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash
The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list).
By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks).
Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget.
Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's inet peer rate limiting subsystem contains a critical design flaw rooted in deterministic data structure ordering, which allows off-path adversaries to manipulate network state and bypass security controls. The system relies on a Red-Black tree to store peer entries for IP addresses, using the remote IP address as the primary key for node placement. This implementation utilizes standard lexicographical comparisons via the inetpeer_addr_cmp function to determine the position of nodes within the tree structure. While this approach is computationally efficient and straightforward, it introduces a severe predictability issue regarding the topology of the data structure. Because the ordering is strictly based on the numerical value of IP addresses, an attacker who can observe network traffic or infer address ranges can accurately deduce the exact layout of the Red-Black tree without needing direct access to the kernel memory space.
This deterministic nature creates a significant vulnerability when combined with the subsystem's garbage collection mechanism. The inet peer system employs aggressive garbage collection policies that trigger eviction of least recently used nodes when the total number of entries exceeds a configured threshold known as inet_peer_threshold. An off-path adversary can exploit this by sending carefully crafted packets to force specific tree traversals and subsequent evictions. By predicting which nodes will be removed from memory based on their deterministic position in the Red-Black tree, an attacker can selectively target and flush rate-limiting state information for specific IP addresses or ports. This capability effectively neutralizes the protective measures intended to prevent network abuse through flooding attacks.
The operational impact of this vulnerability is substantial, enabling two primary classes of attack that compromise both availability and confidentiality aspects of network security. First, attackers can bypass ICMP rate limits by forcing the eviction of peer nodes associated with targeted hosts. When a new packet arrives for an evicted IP address, the system creates a fresh peer entry with its rate-limiting token bucket reset to full capacity. This allows adversaries to send bursts of malicious ICMP traffic that would normally be throttled, facilitating denial-of-service attacks or network reconnaissance activities without triggering standard anti-flood protections. Second, this side-channel primitive can be leveraged for port scanning and service discovery. By observing the timing differences in packet processing or response patterns resulting from these forced evictions and re-creations, attackers can infer which UDP ports are open on a target host. This technique mirrors SAD DNS style attacks, where state manipulation is used to extract information that should remain hidden from off-path observers.
To address this vulnerability, the Linux kernel has implemented a mitigation strategy centered around randomizing the comparison logic for Red-Black tree nodes using SipHash with a secret key. Instead of ordering nodes based on raw IP addresses, the system now computes a hash value using inetpeer_hash_key, which is initialized securely via net_get_random_once to ensure unpredictability across different kernel instances and reboots. This cryptographic randomization ensures that the topology of the Red-Black tree remains opaque to external entities, as an off-path adversary cannot predict how IP addresses map to positions within the data structure without knowledge of the secret key. Consequently, the deterministic eviction gadget is broken because attackers can no longer reliably target specific nodes for removal based on their address values alone.
The technical implementation involves caching the computed 64-bit SipHash value directly in the struct inet_peer structure to optimize performance and avoid redundant computations during tree traversal operations. The system computes the target hash, referred to as dhash, once at the beginning of the inet_getpeer function call rather than recalculating it at every step of the Red-Black walk. This optimization maintains high throughput while ensuring that node ordering is determined by a cryptographically secure random value rather than deterministic IP address sorting. From a classification perspective, this vulnerability aligns with CWE-209 regarding the generation of an error message that includes sensitive information about the environment, as it allows inference of internal state through side channels, and relates to CWE-613 concerning insufficient session expiration or invalidation in rate limiting contexts. In terms of MITRE ATT&CK mapping, this exploit technique corresponds to Tactic TA0042 Command and Control under techniques that involve manipulating network protocols for evasion and reconnaissance, specifically leveraging resource exhaustion and state manipulation to bypass security controls.