PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45905 Linux CVE debrief

A race condition in the Linux kernel's XFRM (IPsec) subsystem can cause a kernel warning when generating ICMP error messages. The vulnerability exists in `icmp_route_lookup()` during reverse path processing for ICMP replies. When an address becomes local between route checks and `ip_route_input()` execution (e.g., via concurrent `ip addr add`), the function may obtain a LOCAL route with `dst.output` set to `ip_rt_bug`. Using this route for ICMP output triggers `dst_output()` to call `ip_rt_bug()`, generating a WARN_ON. The fix adds validation to check `rt2->rt_type` after `ip_route_input()` and treat LOCAL routes as errors, preventing use of invalid output routes.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators running kernels with IPsec/XFRM policies enabled; security teams monitoring for kernel stability issues; network operators using dynamic address configuration on routers or VPN gateways

Technical summary

The vulnerability is a race condition in `icmp_route_lookup()` within the Linux kernel's IPv4 routing and XFRM (IPsec) framework. When processing ICMP error messages in reverse path mode, the function calls `ip_route_input()` to simulate the reverse packet's input path. If the destination address becomes local between the initial flow check and the route lookup (due to concurrent address configuration), `ip_route_input()` returns a LOCAL route with `dst.output` pointing to `ip_rt_bug`. Subsequent use of this route for ICMP output causes `dst_output()` to invoke `ip_rt_bug()`, triggering a kernel WARNING. The fix validates `rt2->rt_type` after `ip_route_input()` and rejects LOCAL routes, preventing invalid output route usage.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the XFRM icmp_route_lookup fix
  • Monitor kernel logs for ip_rt_bug warnings as indicators of potential trigger conditions
  • Review systems using IPsec (XFRM) policies with ICMP error handling
  • Prioritize patching on systems with dynamic address configuration where 'ip addr add' operations may occur during packet processing

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. Six kernel.org stable tree commits are referenced, indicating backports to multiple kernel versions. The issue was resolved in the Linux kernel with a fix that validates route type after reverse path lookup.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45905 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45905

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45905 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45905

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2c1f59005da9dd4b07b26984fd719e36557dc57c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/423ce12d10b426709489d6b84fdaa6d2f31c5652

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9a95ec9144eeff1fc6fbcc21b677e322c6f1430b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b04061f89ffc6168e7ec3c71d0086ec3c3797228

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.