CVE-2026-45905 Overview
CVE-2026-45905 is a race condition in the Linux kernel's IPsec (XFRM) ICMP route lookup logic. The flaw resides in icmp_route_lookup() within net/ipv4/icmp.c, specifically the reverse path handling that calls ip_route_input(). When a destination address becomes local between the initial check and the input route lookup, the kernel obtains a RTN_LOCAL route whose dst.output points to ip_rt_bug. Using that route to emit an ICMP reply triggers a WARN_ON at net/ipv4/route.c:1275 and aborts the transmit path. The issue is a kernel networking stability bug rather than a memory corruption flaw.
Critical Impact
A concurrent ip addr add racing with ICMP error generation can trigger ip_rt_bug() and produce kernel warnings on the network receive path, with potential for denial of service on systems handling XFRM/IPsec traffic.
Affected Products
- Linux kernel branches containing the pre-patch icmp_route_lookup() reverse path logic
- Systems using XFRM/IPsec policies that emit ICMP error messages
- Forwarding and gateway nodes processing tunneled or routed IPv4 traffic
Discovery Timeline
- 2026-05-27 - CVE-2026-45905 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45905
Vulnerability Analysis
The icmp_route_lookup() function performs a multi-step route resolution to send ICMP error messages under XFRM policy. The sequence first looks up an output route for the ICMP reply, then passes it through xfrm_lookup() for policy enforcement. When that lookup is blocked with -EPERM or the destination is not local, the function enters a reverse path that calls xfrm_decode_session_reverse() to construct a reversed flow descriptor fl4_dec with source and destination swapped.
If fl4_dec.saddr is not local, the kernel treats itself as a forwarding node and calls ip_route_input() to simulate the reverse packet's input path. The result rt2 is then passed through xfrm_lookup() with the XFRM_LOOKUP_ICMP flag. The reverse path is required because XFRM policy decisions depend on the direction of the simulated flow.
Root Cause
The defect is a time-of-check to time-of-use (TOCTOU) race between the initial locality test for fl4_dec.saddr and the subsequent ip_route_input() call. A concurrent operation such as ip addr add can make the original packet's source address local in that window. When ip_route_input() then resolves the route, it returns a RTN_LOCAL entry whose dst.output is set to the poison function ip_rt_bug. The pre-patch code does not verify rt2->rt_type before using the route for output. The fix adds a check that rejects RTN_LOCAL results after ip_route_input() and treats them as an error.
Attack Vector
Triggering the race requires concurrent network configuration changes alongside traffic that causes the kernel to emit ICMP errors through the XFRM reverse path. The original reproducer required kernel modifications to widen the race window, indicating the natural window is narrow. Exploitation does not yield code execution. The observable effect is the WARN_ON at ip_rt_bug+0x21/0x30 reached from ip_push_pending_frames → icmp_push_reply → __icmp_send → ip_rcv_finish_core, which aborts the ICMP send and produces kernel log noise.
The vulnerability manifests in the routing decision path inside icmp_route_lookup(). Refer to the upstream commits listed in the references for the precise patch hunks.
Detection Methods for CVE-2026-45905
Indicators of Compromise
- Kernel warnings referencing ip_rt_bug+0x21/0x30 at net/ipv4/route.c:1275 in dmesg or journal output
- Call traces showing ip_push_pending_frames → icmp_push_reply → __icmp_send → ip_rcv_finish_core → ip_rcv
- Bursts of these warnings coinciding with ip addr add operations or address management activity on XFRM-enabled hosts
Detection Strategies
- Parse /var/log/kern.log and journalctl -k for the ip_rt_bug symbol and the route.c line reference
- Correlate kernel warnings with IPsec/XFRM policy state and concurrent network namespace or interface address changes
- Track running kernel versions across the fleet and compare against the patched commits referenced by upstream
Monitoring Recommendations
- Forward kernel logs to a central SIEM and alert on WARN_ON events that match the ip_rt_bug signature
- Monitor IPsec gateways and forwarding nodes for elevated rates of dropped ICMP error generation
- Inventory kernel build identifiers and flag hosts running unpatched stable branches
How to Mitigate CVE-2026-45905
Immediate Actions Required
- Apply the upstream stable kernel updates that add the rt2->rt_type == RTN_LOCAL check after ip_route_input() in icmp_route_lookup()
- Reboot affected systems into the patched kernel and verify the symbol fix is present
- Restrict unprivileged access to network configuration utilities that can call ip addr add on production gateways
Patch Information
The fix is distributed across multiple stable branch commits. See Kernel commit 1c9ef28f643c, Kernel commit 2c1f59005da9, Kernel commit 423ce12d10b4, Kernel commit 81b84de32bb2, Kernel commit 9a95ec9144ee, and Kernel commit b04061f89ffc. The patched code rejects RTN_LOCAL routes returned from ip_route_input() in the ICMP reverse path.
Workarounds
- Avoid runtime ip addr add operations on IPsec gateways under load until the patch is deployed
- Limit which accounts and automation can mutate interface address state on forwarding hosts
- Reduce reliance on XFRM-policy-driven ICMP error generation where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
