CVE-2026-68294

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the QRTR transport of the Linux kernel where port and node states are stored in module-global variables that are not partitioned per network namespace. Specifically, qrtr local nid is a single global node id and qrtr ports is a single global xarray. The functions qrtr port lookup() and qrtr local enqueue() operate on this global state without network-namespace checks, and qrtr create() does not restrict the namespace in which a socket is created.

Consequently, an unprivileged process creating an AF QIPCRTR socket in a separate network namespace can send QRTR datagrams, including control-plane messages like QRTR TYPE NEW SERVER, to QRTR sockets in another namespace. The receiving socket perceives these messages as originating from node id 1, making them indistinguishable from legitimate local clients and breaking network namespace isolation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.