CVE-2026-63914
xfrm: route MIGRATE notifications to caller's netns
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xfrm/af_key netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrm_user.c route their event using xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path was missed. Two consequences of the init_net hardcoding: 1. The notification (selector, old/new endpoint addresses, and the km_address) is delivered to listeners on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host. 2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken. Thread struct net through km_migrate() and the xfrm_mgr.migrate function pointer, drop the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and pass the caller's net (already in scope in xfrm_migrate() via sock_net(skb->sk)) all the way down. struct xfrm_mgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id) since the pernet conversion. The five other pfkey_broadcast() callers in af_key.c already pass xs_net(x), sock_net(sk) or a per-netns net, so this only removes the &init_net outlier.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel.
- Apply kernel patches addressing netns handling.
- Ensure correct notification routing.
- Verify IKEv2 MOBIKE functionality.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63914.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63914 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63914
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63914 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63914 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': 'bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': '6df8157547347b5257bf640a0ae3dfc4411e06cd', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': 'fe463798343382c8fe9416a95959f005a3c30aa5', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': '00f2c451e57df50b1151d9b2254878f106b7c892', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': 'a306cf2ac8849c487791369fad6f216399d000f6', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': '448bb92ca101dde8a6e88b4dc824044b4e341604', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': '26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126', 'versionType': 'git'}, {'status': 'affected', 'version': '5c79de6e79cd8ecfbae28886be3ee49044f3a4d4', 'lessThan': '7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4', 'versionType': 'git'}], 'programFiles': ['include/net/xfrm.h', 'net/key/af_key.c', 'net/xfrm/xfrm_policy.c', 'net/xfrm/xfrm_state.c', 'net/xfrm/xfrm_user.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.21'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.21', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/net/xfrm.h', 'net/key/af_key.c', 'net/xfrm/xfrm_policy.c', 'net/xfrm/xfrm_state.c', 'net/xfrm/xfrm_user.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xfrm/af_key netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrm_user.c route their event using xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path was missed. Two consequences of the init_net hardcoding: 1. The notification (selector, old/new endpoint addresses, and the km_address) is delivered to listeners on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host. 2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken. Thread struct net through km_migrate() and the xfrm_mgr.migrate function pointer, drop the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and pass the caller's net (already in scope in xfrm_migrate() via sock_net(skb->sk)) all the way down. struct xfrm_mgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id) since the pernet conversion. The five other pfkey_broadcast() callers in af_key.c already pass xs_net(x), sock_net(sk) or a per-netns net, so this only removes the &init_net outlier. Added Reference https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892 Added Reference https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126 Added Reference https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604 Added Reference https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd Added Reference https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4 Added Reference https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6 Added Reference https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad Added Reference https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5