---
id: CVE-2026-63914
title: 'xfrm: route MIGRATE notifications to caller''s netns'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: route MIGRATE notifications to caller's netns

  xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()
  in net/key/af_key.c both hardcode &init_net fo…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    6df8157547347b5257bf640a0ae3dfc4411e06cd
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    fe463798343382c8fe9416a95959f005a3c30aa5
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    00f2c451e57df50b1151d9b2254878f106b7c892
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    a306cf2ac8849c487791369fad6f216399d000f6
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    448bb92ca101dde8a6e88b4dc824044b4e341604
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126
  - >-
    Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 <
    7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4
  - Linux 2.6.21
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:33:13.785456Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:11.103Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63914'
references:
  - url: 'https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad'
  - url: 'https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd'
  - url: 'https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5'
  - url: 'https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892'
  - url: 'https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6'
  - url: 'https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604'
  - url: 'https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126'
  - url: 'https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.04703
ingestedAt: '2026-10-16T17:24:46.776Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: route MIGRATE notifications to caller's netns

xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()
in net/key/af_key.c both hardcode &init_net for the multicast that
announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE.

XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the
rest of the xfrm/af_key netlink path was made netns-aware in 2008.
The other 14 multicast paths in xfrm_user.c route their event using
xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path
was missed.

Two consequences of the init_net hardcoding:

  1. The notification (selector, old/new endpoint addresses, and the
     km_address) is delivered to listeners on init_net's
     XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on
     the issuing netns. An IKE daemon running in init_net therefore
     receives migration notifications originating from any other
     netns on the host.

  2. An IKE daemon running inside a non-init netns and subscribed
     to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the
     notification of its own migration. IKEv2 MOBIKE / address-update
     handling inside a netns is silently broken.

Thread struct net through km_migrate() and the xfrm_mgr.migrate
function pointer, drop the &init_net override in xfrm_send_migrate()
and pfkey_send_migrate(), and pass the caller's net (already in
scope in xfrm_migrate() via sock_net(skb->sk)) all the way down.
struct xfrm_mgr is in-tree only and not exported as a stable API,
so the function-pointer signature change is internal.

pfkey_broadcast() is already netns-aware via net_generic(net,
pfkey_net_id) since the pernet conversion. The five other
pfkey_broadcast() callers in af_key.c already pass xs_net(x),
sock_net(sk) or a per-netns net, so this only removes the
&init_net outlier.

## Affected

- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < 6df8157547347b5257bf640a0ae3dfc4411e06cd`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < fe463798343382c8fe9416a95959f005a3c30aa5`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < 00f2c451e57df50b1151d9b2254878f106b7c892`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < a306cf2ac8849c487791369fad6f216399d000f6`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < 448bb92ca101dde8a6e88b4dc824044b4e341604`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < 26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126`
- `Linux >= 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 < 7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4`
- `Linux 2.6.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.