CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: restrict socket creation to the initial network namespace

QRTR keeps its entire port and node state in module-global variables
that are not partitioned per network namespace: qrtr_local_nid is a
single global node id (always 1) and qrtr_ports is a single global
xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that
global state with no network-namespace check, and qrtr_create() places
no restriction on the namespace a socket is created in.

As a result an unprivileged process that creates an AF_QIPCRTR socket
in a separate network namespace, e.g. via
unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -
including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR
sockets owned by another namespace, and vice versa. The receiving
socket sees such a message as coming from node id 1, indistinguishable
from a legitimate local client, breaking the isolation that network
namespaces are expected to provide.

QRTR is a transport to global hardware endpoints (the modem and other
remote processors) and has no per-namespace semantics; its in-kernel
name service already creates its socket in init_net only. Confine the
socket family to the initial network namespace, as other
non-namespace-aware socket families do (see llc_ui_create() and the
ieee802154 socket code).

The Linux kernel CVE team has assigned CVE-2026-68294 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.7 with commit bdabad3e363d825ddf9679dd431cca0b2c30f881 and fixed in 6.6.148 with commit 4b95e1f0d6e6342c427cb341ee18a894b146b789
	Issue introduced in 4.7 with commit bdabad3e363d825ddf9679dd431cca0b2c30f881 and fixed in 6.12.101 with commit f488116df769bdaf89c93371350e49e12133e70f
	Issue introduced in 4.7 with commit bdabad3e363d825ddf9679dd431cca0b2c30f881 and fixed in 6.18.42 with commit 8150c48fb978e01689f94ed80148f8a7499ae571
	Issue introduced in 4.7 with commit bdabad3e363d825ddf9679dd431cca0b2c30f881 and fixed in 7.1.6 with commit 659b9b4f194bb56b9903cc95e786ef1d438baa7d
	Issue introduced in 4.7 with commit bdabad3e363d825ddf9679dd431cca0b2c30f881 and fixed in 7.2-rc5 with commit 3b536db8fb32da9e9c62f2bb45e2e319331f0426

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68294
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/qrtr/af_qrtr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789
	https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f
	https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571
	https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d
	https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426