CVE-2026-63914

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: route MIGRATE notifications to caller&amp;#39;s netns<br /> <br /> xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()<br /> in net/key/af_key.c both hardcode &amp;init_net for the multicast that<br /> announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE.<br /> <br /> XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the<br /> rest of the xfrm/af_key netlink path was made netns-aware in 2008.<br /> The other 14 multicast paths in xfrm_user.c route their event using<br /> xs_net(x), xp_net(xp) or sock_net(skb-&gt;sk); only the migrate path<br /> was missed.<br /> <br /> Two consequences of the init_net hardcoding:<br /> <br /> 1. The notification (selector, old/new endpoint addresses, and the<br /> km_address) is delivered to listeners on init_net&amp;#39;s<br /> XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on<br /> the issuing netns. An IKE daemon running in init_net therefore<br /> receives migration notifications originating from any other<br /> netns on the host.<br /> <br /> 2. An IKE daemon running inside a non-init netns and subscribed<br /> to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the<br /> notification of its own migration. IKEv2 MOBIKE / address-update<br /> handling inside a netns is silently broken.<br /> <br /> Thread struct net through km_migrate() and the xfrm_mgr.migrate<br /> function pointer, drop the &amp;init_net override in xfrm_send_migrate()<br /> and pfkey_send_migrate(), and pass the caller&amp;#39;s net (already in<br /> scope in xfrm_migrate() via sock_net(skb-&gt;sk)) all the way down.<br /> struct xfrm_mgr is in-tree only and not exported as a stable API,<br /> so the function-pointer signature change is internal.<br /> <br /> pfkey_broadcast() is already netns-aware via net_generic(net,<br /> pfkey_net_id) since the pernet conversion. The five other<br /> pfkey_broadcast() callers in af_key.c already pass xs_net(x),<br /> sock_net(sk) or a per-netns net, so this only removes the<br /> &amp;init_net outlier.