# CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

Status: published. Published: 2026-05-27. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

icmp_route_lookup() performs multiple route lookups to find a suitable
route for sending ICMP error messages, with special handling for XFRM
(IPsec) policies.

The lookup sequence is:
1. First, lookup output route for ICMP reply (dst = original src)
2. Pass through xfrm_lookup() for policy check
3. If blocked (-EPERM) or dst is not local, enter "reverse path"
4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec
   which reverses the original packet's flow (saddr<->daddr swapped)
5. If fl4_dec.saddr is local (we are the original destination), use
   __ip_route_output_key() for output route lookup
6. If fl4_dec.saddr is NOT local (we are a forwarding node), use
   ip_route_input() to simulate the reverse packet's input path
7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag

The bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr
(original packet's source) as destination. If this address becomes local
between the initial check and ip_route_input() call (e.g., due to
concurrent "ip addr add"), ip_route_input() returns a LOCAL route with
dst.output set to ip_rt_bug.

This route is then used for ICMP output, causing dst_output() to call
ip_rt_bug(), triggering a WARN_ON:

 ------------[ cut here ]------------
 WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1
 Call Trace:
  <TASK>
  ip_push_pending_frames+0x202/0x240
  icmp_push_reply+0x30d/0x430
  __icmp_send+0x1149/0x24f0
  ip_options_compile+0xa2/0xd0
  ip_rcv_finish_core+0x829/0x1950
  ip_rcv+0x2d7/0x420
  __netif_receive_skb_one_core+0x185/0x1f0
  netif_receive_skb+0x90/0x450
  tun_get_user+0x3413/0x3fb0
  tun_chr_write_iter+0xe4/0x220
  ...

Fix this by checking rt2->rt_type after ip_route_input(). If it's
RTN_LOCAL, the route cannot be used for output, so treat it as an error.

The reproducer requires kernel modification to widen the race window,
making it unsuitable as a selftest. It is available at:

  https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < 9a95ec9144eeff1fc6fbcc21b677e322c6f1430b (affected, git); ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < 2c1f59005da9dd4b07b26984fd719e36557dc57c (affected, git); ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < b04061f89ffc6168e7ec3c71d0086ec3c3797228 (affected, git); ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < 1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1 (affected, git); ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < 423ce12d10b426709489d6b84fdaa6d2f31c5652 (affected, git); ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063; < 81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00 (affected, git). Source: CNA: Linux
- Linux / Linux: 2.6.25 (affected); ≥ 0; < 2.6.25 (unaffected, semver); ≥ 6.1.165; ≤ 6.1.* (unaffected, semver); ≥ 6.6.128; ≤ 6.6.* (unaffected, semver); ≥ 6.12.75; ≤ 6.12.* (unaffected, semver); ≥ 6.18.14; ≤ 6.18.* (unaffected, semver); ≥ 6.19.4; ≤ 6.19.* (unaffected, semver); ≥ 7.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.11% as of 2026-11-06; percentile 1.36%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/9a95ec9144eeff1fc6fbcc21b677e322c6f1430b (CNA: Linux)

- https://git.kernel.org/stable/c/2c1f59005da9dd4b07b26984fd719e36557dc57c (CNA: Linux)

- https://git.kernel.org/stable/c/b04061f89ffc6168e7ec3c71d0086ec3c3797228 (CNA: Linux)

- https://git.kernel.org/stable/c/1c9ef28f643cce34a6a6c36c8f4d6d60a60db7e1 (CNA: Linux)

- https://git.kernel.org/stable/c/423ce12d10b426709489d6b84fdaa6d2f31c5652 (CNA: Linux)

- https://git.kernel.org/stable/c/81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-45905; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-45905; retrieved 2026-11-06; source updated Not reported

Revision: 69188d91a6709f3342bd462181ace9c03b737dbd718ca3e6c8c15d29d4e8f943

Canonical: https://y2.dev/cve/CVE-2026-45905

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.