GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63914 (GCVE-0-2026-63914)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
xfrm: route MIGRATE notifications to caller's netns
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xfrm/af_key netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrm_user.c route their event using xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path was missed. Two consequences of the init_net hardcoding: 1. The notification (selector, old/new endpoint addresses, and the km_address) is delivered to listeners on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host. 2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken. Thread struct net through km_migrate() and the xfrm_mgr.migrate function pointer, drop the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and pass the caller's net (already in scope in xfrm_migrate() via sock_net(skb->sk)) all the way down. struct xfrm_mgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id) since the pernet conversion. The five other pfkey_broadcast() callers in af_key.c already pass xs_net(x), sock_net(sk) or a per-netns net, so this only removes the &init_net outlier.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < 6df8157547347b5257bf640a0ae3dfc4411e06cd (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < fe463798343382c8fe9416a95959f005a3c30aa5 (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < 00f2c451e57df50b1151d9b2254878f106b7c892 (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < a306cf2ac8849c487791369fad6f216399d000f6 (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < 448bb92ca101dde8a6e88b4dc824044b4e341604 (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < 26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126 (git)
Affected: 5c79de6e79cd8ecfbae28886be3ee49044f3a4d4 , < 7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.21
Unaffected: 0 , < 2.6.21 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/key/af_key.c",
            "net/xfrm/xfrm_policy.c",
            "net/xfrm/xfrm_state.c",
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "6df8157547347b5257bf640a0ae3dfc4411e06cd",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "fe463798343382c8fe9416a95959f005a3c30aa5",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "00f2c451e57df50b1151d9b2254878f106b7c892",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "a306cf2ac8849c487791369fad6f216399d000f6",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "448bb92ca101dde8a6e88b4dc824044b4e341604",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/key/af_key.c",
            "net/xfrm/xfrm_policy.c",
            "net/xfrm/xfrm_state.c",
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.21"
            },
            {
              "lessThan": "2.6.21",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: route MIGRATE notifications to caller\u0027s netns\n\nxfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()\nin net/key/af_key.c both hardcode \u0026init_net for the multicast that\nannounces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE.\n\nXFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the\nrest of the xfrm/af_key netlink path was made netns-aware in 2008.\nThe other 14 multicast paths in xfrm_user.c route their event using\nxs_net(x), xp_net(xp) or sock_net(skb-\u003esk); only the migrate path\nwas missed.\n\nTwo consequences of the init_net hardcoding:\n\n  1. The notification (selector, old/new endpoint addresses, and the\n     km_address) is delivered to listeners on init_net\u0027s\n     XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on\n     the issuing netns. An IKE daemon running in init_net therefore\n     receives migration notifications originating from any other\n     netns on the host.\n\n  2. An IKE daemon running inside a non-init netns and subscribed\n     to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the\n     notification of its own migration. IKEv2 MOBIKE / address-update\n     handling inside a netns is silently broken.\n\nThread struct net through km_migrate() and the xfrm_mgr.migrate\nfunction pointer, drop the \u0026init_net override in xfrm_send_migrate()\nand pfkey_send_migrate(), and pass the caller\u0027s net (already in\nscope in xfrm_migrate() via sock_net(skb-\u003esk)) all the way down.\nstruct xfrm_mgr is in-tree only and not exported as a stable API,\nso the function-pointer signature change is internal.\n\npfkey_broadcast() is already netns-aware via net_generic(net,\npfkey_net_id) since the pernet conversion. The five other\npfkey_broadcast() callers in af_key.c already pass xs_net(x),\nsock_net(sk) or a per-netns net, so this only removes the\n\u0026init_net outlier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local NETLINK_XFRM or PF_KEY sockets (xfrm_do_migrate/pfkey_migrate); there is no network packet receive path to xfrm_migrate().\nAC:L - Once IPsec policies and SAs exist (which a CAP_NET_ADMIN caller can create), a successful migrate reliably multicasts the notification; a listener in init_net receives cross-namespace events without winning a race or depending on attacker-uncontrollable state.\nPR:L - Both triggering XFRM_MSG_MIGRATE/SADB_X_MIGRATE and subscribing to XFRMNLGRP_MIGRATE require CAP_NET_ADMIN, which is obtainable in a user namespace (e.g. unshare -U while remaining in init_net) without real root in the init user namespace.\nUI:N - Exploitation requires no victim user action beyond normal background IPsec/MOBIKE operation; the attacker passively listens for migrate notifications.\nS:C - The flaw breaks network-namespace isolation by delivering per-netns IPsec migration notifications to init_net listeners, crossing the security boundary between isolated network namespaces and the host namespace.\nC:H - Successful exploitation discloses sensitive IPsec/MOBIKE data\u2014traffic selectors, old/new tunnel endpoint addresses, and km_address negotiation endpoints\u2014from victim network namespaces to unauthorized init_net listeners.\nI:N - The bug only misroutes multicast notifications; it does not modify kernel memory, IPsec state, or any data beyond the intended migration operation itself.\nA:L - The complementary failure mode silently breaks IKEv2 MOBIKE address-update handling in non-init network namespaces because the issuing namespace never receives its own migration notification, degrading VPN availability without kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:08.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892"
        },
        {
          "url": "https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604"
        },
        {
          "url": "https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4"
        }
      ],
      "title": "xfrm: route MIGRATE notifications to caller\u0027s netns",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63914",
    "datePublished": "2026-07-19T14:55:18.618Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:08.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63914",
      "date": "2026-09-19",
      "epss": "0.0016",
      "percentile": "0.05607"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xfrm.h",
                  "net/key/af_key.c",
                  "net/xfrm/xfrm_policy.c",
                  "net/xfrm/xfrm_state.c",
                  "net/xfrm/xfrm_user.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6df8157547347b5257bf640a0ae3dfc4411e06cd",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe463798343382c8fe9416a95959f005a3c30aa5",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "00f2c451e57df50b1151d9b2254878f106b7c892",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a306cf2ac8849c487791369fad6f216399d000f6",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "448bb92ca101dde8a6e88b4dc824044b4e341604",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4",
                    "status": "affected",
                    "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xfrm.h",
                  "net/key/af_key.c",
                  "net/xfrm/xfrm_policy.c",
                  "net/xfrm/xfrm_state.c",
                  "net/xfrm/xfrm_user.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.21"
                  },
                  {
                    "lessThan": "2.6.21",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: route MIGRATE notifications to caller\u0027s netns\n\nxfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()\nin net/key/af_key.c both hardcode \u0026init_net for the multicast that\nannounces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE.\n\nXFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the\nrest of the xfrm/af_key netlink path was made netns-aware in 2008.\nThe other 14 multicast paths in xfrm_user.c route their event using\nxs_net(x), xp_net(xp) or sock_net(skb-\u003esk); only the migrate path\nwas missed.\n\nTwo consequences of the init_net hardcoding:\n\n  1. The notification (selector, old/new endpoint addresses, and the\n     km_address) is delivered to listeners on init_net\u0027s\n     XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on\n     the issuing netns. An IKE daemon running in init_net therefore\n     receives migration notifications originating from any other\n     netns on the host.\n\n  2. An IKE daemon running inside a non-init netns and subscribed\n     to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the\n     notification of its own migration. IKEv2 MOBIKE / address-update\n     handling inside a netns is silently broken.\n\nThread struct net through km_migrate() and the xfrm_mgr.migrate\nfunction pointer, drop the \u0026init_net override in xfrm_send_migrate()\nand pfkey_send_migrate(), and pass the caller\u0027s net (already in\nscope in xfrm_migrate() via sock_net(skb-\u003esk)) all the way down.\nstruct xfrm_mgr is in-tree only and not exported as a stable API,\nso the function-pointer signature change is internal.\n\npfkey_broadcast() is already netns-aware via net_generic(net,\npfkey_net_id) since the pernet conversion. The five other\npfkey_broadcast() callers in af_key.c already pass xs_net(x),\nsock_net(sk) or a per-netns net, so this only removes the\n\u0026init_net outlier."
          }
        ],
        "id": "CVE-2026-63914",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 4.7,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:09.373",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:58+00:00",
      "cve": "CVE-2026-63914",
      "id": "CVE-2026-63914",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: route MIGRATE notifications to caller\u0027s netns",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63914.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:58:16Z",
      "cve": "CVE-2026-63914",
      "id": "CVE-2026-63914",
      "initial_release_date": "2026-07-21T13:03:40Z",
      "product_status:known_affected": "372",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63914",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63914.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.