EUVD-2026-64349
GHSA-92r4-fqr3-4rrc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation needs a privileged non-default netns frag-timeout config (PR:L) and a timing race (AC:H); impact is chiefly kernel memory corruption/DoS (A:H) with only limited potential C/I effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: publish queues before arming timer
inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published.
The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference.
Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.
AnalysisAI
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a network namespace whose IP fragment reassembly timeout is configured to zero or a negative value - the description's 'if the namespace fragment timeout is zero or negative' IS the concrete precondition - plus active exercise of the IP fragment reassembly path (receiving fragmented packets that reach inet_frag_create()), plus winning the race in which the timer fires before the queue is inserted into the fqdir rhashtable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local actor with the ability to configure a network namespace (for example a container tenant granted CAP_NET_ADMIN in its own netns) sets the IP fragment reassembly timeout to zero or negative, then sends fragmented IP traffic to drive inet_frag_create(); the timer fires against the not-yet-published queue and unbalances the hash reference, producing a stale node and use-after-free-style corruption that can crash the kernel or potentially be groomed for further impact. No public exploit code is identified at time of analysis, and reliable exploitation is complicated by the narrow timer-vs-insertion race window. |
| Remediation | Apply the kernel fix that reorders inet_frag_create() to publish the queue into the fqdir rhashtable before arming the expiry timer under the queue lock; upstream fix available as stable-tree commits (9f904dd3e455..., 928128865e43..., 653d7ddf6cba...) per https://git.kernel.org/stable/c , but a cleanly tagged released version could not be independently confirmed from the supplied data, so pull the fix from your distribution's patched kernel once published and confirm the commit is included. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit production Linux systems to identify those with non-default fragment timeout configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today