CVE-2026-90110 Linux CVE debrief

Who should care

Linux kernel developers and administrators, network security teams, and organizations using Linux-based systems should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

A critical vulnerability in the Linux kernel's inetpeer rate limiting system allows off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports. Linux kernel developers and administrators, network security teams, and organizations using Linux-based systems should assess their exposure and take necessary actions to mitigate the vulnerability.

• Off-path attackers can bypass IP-keyed ICMP rate limits.
• Off-path attackers can infer open UDP ports.
• The vulnerability can be used to launch further attacks on the Linux kernel.

Technical summary

The inetpeer rate limiting system in the Linux kernel stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. An off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups. By combining deterministic tree traversal with aggressive garbage collection, an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports.

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patch to randomize the RB-tree node comparison logic using SipHash with a secret key.
• Monitor network traffic for potential attacks on the inetpeer rate limiting system.
• Implement additional security measures to prevent off-path attacks on the Linux kernel.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the mitigation. The Linux kernel's inetpeer rate limiting system is vulnerable to attacks that allow off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.