CVE-2026-68294: Linux Kernel QRTR Privilege Escalation

CVE-2026-68294 Overview

CVE-2026-68294 is a Linux kernel vulnerability in the Qualcomm IPC Router (QRTR) socket family. The QRTR module stores its port and node state in module-global variables that are not partitioned per network namespace. Functions such as qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no namespace check, and qrtr_create() places no restriction on which namespace can create an AF_QIPCRTR socket. An unprivileged process that creates a QRTR socket in a separate network namespace can send datagrams, including control-plane messages like QRTR_TYPE_NEW_SERVER, to sockets in other namespaces.

Critical Impact
A local unprivileged user can bypass network namespace isolation and inject QRTR control-plane messages into sockets owned by another namespace, breaking container boundaries.

Affected Products

Linux kernel (upstream), versions containing the QRTR socket family without namespace confinement
Distributions shipping the net/qrtr module (AF_QIPCRTR socket family)
Qualcomm-based platforms and modem-hosting systems that rely on QRTR transport

Discovery Timeline

2026-08-10 - CVE-2026-68294 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68294

Vulnerability Analysis

QRTR is an in-kernel transport used to reach global hardware endpoints such as the modem and other remote processors. Its state model predates namespace-aware socket design. The module keeps qrtr_local_nid as a single global node identifier fixed to 1, and qrtr_ports as a single global xarray shared across the system. Any process holding a QRTR socket in any namespace resolves peers through that same global table.

Because QRTR datagrams identify the sender by node id, a message crossing namespaces appears to the receiver as originating from node id 1, indistinguishable from a legitimate local client. This lets an unprivileged process forge control-plane traffic against services owned by another namespace, including the in-kernel name service which itself only binds in init_net.

Root Cause

The root cause is missing network-namespace scoping in the QRTR socket family. qrtr_create() does not restrict the namespace in which an AF_QIPCRTR socket can be instantiated, and the port lookup and enqueue paths do not compare the socket's net against the caller's net. The result is a Broken Access Control condition where namespace isolation is not enforced across QRTR's global port and node state.

Attack Vector

A local unprivileged attacker calls unshare(CLONE_NEWUSER | CLONE_NEWNET) to enter a fresh user and network namespace. Inside that namespace, the attacker creates an AF_QIPCRTR socket and sends QRTR datagrams. Because the port table is global, those datagrams reach QRTR sockets bound in init_net or in any other namespace on the host. The attacker can deliver messages such as QRTR_TYPE_NEW_SERVER to spoof service registration or otherwise manipulate consumers of the QRTR name service.

No synthetic exploit is reproduced here. Technical detail is available in the upstream fix commits referenced by the Linux Kernel Commit #3b536db8 and the Linux Kernel Commit #f488116d records.

Detection Methods for CVE-2026-68294

Indicators of Compromise

Unexpected use of the AF_QIPCRTR (value 42) socket family by processes running inside containers or non-initial network namespaces.
QRTR control messages of type QRTR_TYPE_NEW_SERVER originating from processes that are not the platform's QRTR name service.
Calls to unshare(CLONE_NEWUSER | CLONE_NEWNET) immediately followed by socket(AF_QIPCRTR, ...) from unprivileged user IDs.

Detection Strategies

Audit socket() syscalls with family AF_QIPCRTR using auditd, sysmon-for-linux, or eBPF tooling, and alert when the calling task is not in the initial network namespace.
Trace qrtr_create, qrtr_local_enqueue, and qrtr_port_lookup with bpftrace or perf to correlate senders and receivers across namespaces on kernels that predate the fix.
Baseline expected QRTR consumers per host and flag any new process that opens an AF_QIPCRTR socket outside that allowlist.

Monitoring Recommendations

Ingest kernel audit records for socket creation into a centralized log store and alert on AF_QIPCRTR usage from container runtimes.
Track kernel version and QRTR patch status across the fleet and prioritize hosts with Qualcomm modem or remote-processor stacks.
Correlate namespace creation events (unshare, setns) with subsequent QRTR socket activity to identify probing behavior.

How to Mitigate CVE-2026-68294

Immediate Actions Required

Apply the upstream kernel patches that confine AF_QIPCRTR socket creation to init_net, mirroring the pattern used by llc_ui_create() and the ieee802154 socket code.
On systems that do not require QRTR, blacklist the qrtr and qrtr-smd/qrtr-tun modules to remove the attack surface entirely.
Restrict unprivileged user namespace creation on hosts where it is not required by setting kernel.unprivileged_userns_clone=0 or the equivalent sysctl.

Patch Information

Fixes are available in the upstream stable trees. See the Linux Kernel Commit #3b536db8, Linux Kernel Commit #4b95e1f0, Linux Kernel Commit #659b9b4f, Linux Kernel Commit #8150c48f, and Linux Kernel Commit #f488116d. Distribution kernels should be updated to a build that includes these commits.

Workarounds

Block loading of the QRTR module on hosts that do not need Qualcomm IPC transport.
Disable unprivileged user namespaces to remove the primary path an unprivileged attacker uses to reach AF_QIPCRTR from a separate namespace.
Apply seccomp profiles to container workloads that deny the AF_QIPCRTR socket family.

bash

# Prevent the qrtr module from loading
echo 'blacklist qrtr' | sudo tee /etc/modprobe.d/blacklist-qrtr.conf
echo 'install qrtr /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-qrtr.conf

# Disable unprivileged user namespaces (Debian/Ubuntu style)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system