PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45905 Linux CVE debrief

A race condition in the Linux kernel's XFRM (IPsec) subsystem can cause a kernel warning when generating ICMP error messages. The vulnerability exists in `icmp_route_lookup()` during reverse path processing for ICMP replies. When an address becomes local between route checks and `ip_route_input()` execution (e.g., via concurrent `ip addr add`), the function may obtain a LOCAL route with `dst.output` set to `ip_rt_bug`. Using this route for ICMP output triggers `dst_output()` to call `ip_rt_bug()`, generating a WARN_ON. The fix adds validation to check `rt2->rt_type` after `ip_route_input()` and treat LOCAL routes as errors, preventing use of invalid output routes.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with IPsec/XFRM policies enabled; security teams monitoring for kernel stability issues; network operators using dynamic address configuration on routers or VPN gateways

Technical summary

The vulnerability is a race condition in `icmp_route_lookup()` within the Linux kernel's IPv4 routing and XFRM (IPsec) framework. When processing ICMP error messages in reverse path mode, the function calls `ip_route_input()` to simulate the reverse packet's input path. If the destination address becomes local between the initial flow check and the route lookup (due to concurrent address configuration), `ip_route_input()` returns a LOCAL route with `dst.output` pointing to `ip_rt_bug`. Subsequent use of this route for ICMP output causes `dst_output()` to invoke `ip_rt_bug()`, triggering a kernel WARNING. The fix validates `rt2->rt_type` after `ip_route_input()` and rejects LOCAL routes, preventing invalid output route usage.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the XFRM icmp_route_lookup fix
  • Monitor kernel logs for ip_rt_bug warnings as indicators of potential trigger conditions
  • Review systems using IPsec (XFRM) policies with ICMP error handling
  • Prioritize patching on systems with dynamic address configuration where 'ip addr add' operations may occur during packet processing

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. Six kernel.org stable tree commits are referenced, indicating backports to multiple kernel versions. The issue was resolved in the Linux kernel with a fix that validates route type after reverse path lookup.

Official resources

2026-05-27