CVE-2026-90110

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The inetpeer rate limiting system uses a Red-Black tree to store peer entries keyed deterministically by remote IP address. Since lookups use standard lexicographical comparisons via the inetpeer addr cmp() function, an off-path adversary can predict the tree topology and the sequence of nodes traversed. By triggering aggressive garbage collection when the tree size exceeds inet peer threshold, an attacker can force the eviction of specific inet peer nodes. When these nodes are recreated, their rate-limiting token buckets, specifically rate tokens and rate last, are reset to full capacity. This creates a side-channel that allows attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.