CVE-2026-63914: Linux Kernel Privilege Escalation Flaw

CVE-2026-63914 Overview

CVE-2026-63914 is a Linux kernel vulnerability in the xfrm (IPsec transform) subsystem. The flaw resides in xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c, which hardcode &init_net when sending XFRM_MSG_MIGRATE / SADB_X_MIGRATE multicast notifications. Notifications originating in any network namespace leak to listeners in the initial namespace instead of the caller's namespace. IKE daemons running in non-init namespaces never receive their own migration notifications, silently breaking IKEv2 MOBIKE and address-update handling. The issue represents a cross-namespace information disclosure and a network isolation boundary failure.

Critical Impact
XFRM migration notifications cross network namespace boundaries, exposing IPsec selectors, endpoint addresses, and key manager data to init_net listeners while breaking MOBIKE handling inside containers.

Affected Products

Linux kernel with CONFIG_XFRM / CONFIG_XFRM_MIGRATE enabled
Linux kernel net/xfrm/xfrm_user.c (XFRM netlink interface)
Linux kernel net/key/af_key.c (PF_KEY v2 interface)

Discovery Timeline

2026-07-19 - CVE-2026-63914 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63914

Vulnerability Analysis

The Linux XFRM subsystem became network namespace (netns) aware in 2008, and 14 of the 15 multicast notification paths in xfrm_user.c correctly route events using xs_net(x), xp_net(xp), or sock_net(skb->sk). The XFRM_MSG_MIGRATE path was missed during that conversion. Both xfrm_send_migrate() and pfkey_send_migrate() unconditionally pass &init_net to their multicast send routines.

As a result, migration notifications carrying the migration selector, old and new endpoint addresses, and the km_address structure are delivered to XFRMNLGRP_MIGRATE and PF_KEY BROADCAST_ALL listeners in the initial namespace. Any IKE daemon in init_net observes IPsec migration events from every other namespace on the host.

Root Cause

The root cause is an incomplete netns conversion: the migrate multicast path retained a hardcoded &init_net reference while surrounding code was refactored to per-namespace routing. The xfrm_mgr.migrate function pointer signature did not thread struct net from the caller to the notification sender. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id), so only the migrate call site was passing the wrong namespace.

Attack Vector

A local user with CAP_NET_ADMIN inside a non-init network namespace, such as a container or unprivileged user namespace, can trigger xfrm_migrate() on an IPsec state. The resulting notification bypasses the namespace boundary and reaches listeners in init_net. Conversely, a legitimate IKE daemon inside the container never observes its own migration event, breaking MOBIKE-driven address updates. The fix threads struct net through km_migrate() and the xfrm_mgr.migrate callback, replacing &init_net with the caller's namespace obtained via sock_net(skb->sk) in xfrm_migrate().

The vulnerability manifests in the notification broadcast routine. See the upstream commits in the references section for the complete fix and backports.

Detection Methods for CVE-2026-63914

Indicators of Compromise

Unexpected XFRM_MSG_MIGRATE netlink messages arriving on XFRMNLGRP_MIGRATE subscribers in init_net when no host-level IPsec migration was initiated.
IKE daemons running inside containers reporting missing MOBIKE address-update notifications despite successful kernel-side migration.
PF_KEY SADB_X_MIGRATE messages observed on init_netBROADCAST_ALL groups containing selectors for tunnels owned by other namespaces.

Detection Strategies

Audit running kernel version against the fixed commits 00f2c451, 26ce8dbf, 448bb92c, 6df81575, 7e2a4f7c, a306cf2a, bafc7d07, and fe463798 across stable branches.
Correlate NETLINK_XFRM socket activity in init_net with the originating namespace of xfrm_migrate netlink requests via eBPF tracing on km_migrate and xfrm_send_migrate.
Monitor container workloads that run strongSwan, Libreswan, or other IKEv2 daemons for MOBIKE failures logged as missed migration events.

Monitoring Recommendations

Enable auditd rules on NETLINK_XFRM socket creation and XFRM_MSG_MIGRATE messages to establish a baseline of legitimate migrate traffic.
Instrument xfrm_migrate(), xfrm_send_migrate(), and pfkey_send_migrate() with kprobes to capture the caller's net pointer versus the notification target namespace.
Alert on any process in init_net receiving XFRMNLGRP_MIGRATE messages when no host-level IPsec policy change is expected.

How to Mitigate CVE-2026-63914

Immediate Actions Required

Update the Linux kernel to a stable release containing the fix commits listed in the references and reboot affected hosts.
Inventory hosts running container workloads with IPsec or IKEv2 MOBIKE inside namespaces and prioritize them for patching.
Restrict CAP_NET_ADMIN inside untrusted containers and user namespaces to limit who can invoke xfrm_migrate.

Patch Information

The fix threads struct net through km_migrate() and the xfrm_mgr.migrate function pointer, removes the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and passes the caller's net obtained from sock_net(skb->sk) in xfrm_migrate(). The change is internal because struct xfrm_mgr is not an exported stable API. The fix is available across multiple stable branches via commits 00f2c45, 26ce8db, 448bb92, 6df8157, 7e2a4f7, a306cf2, bafc7d0, and fe46379.

Workarounds

Disable CONFIG_XFRM_MIGRATE in the kernel build where IKEv2 MOBIKE is not required for containerized workloads.
Deny the CAP_NET_ADMIN capability inside container runtimes using seccomp or AppArmor profiles to prevent unprivileged triggering of migrate notifications.
Avoid running IKE daemons inside non-init network namespaces until affected hosts are patched.

bash

# Verify running kernel and confirm patch presence
uname -r

# Example: drop CAP_NET_ADMIN in Docker containers that do not require IPsec
docker run --cap-drop=NET_ADMIN <image>

# Example: audit XFRM netlink activity
auditctl -a always,exit -F arch=b64 -S socket -F a0=16 -F a2=6 -k xfrm_netlink