CVE-2026-63914

A flaw was found in the Linux kernel's xfrm and af_key modules. The xfrm_send_migrate() and pfkey_send_migrate() functions incorrectly hardcode the init_net (initial network namespace) for migration notifications. This misconfiguration leads to two main issues: migration notifications are delivered to the init_net's listeners instead of the correct network namespace, potentially disclosing information to unintended recipients. Additionally, an Internet Key Exchange (IKE) daemon operating in a non-initial network namespace will not receive its own migration notifications, which can silently break IKEv2 MOBIKE (Mobile Internet Key Exchange) and address-update handling.

Red Hat has evaluated this issue as having a Moderate severity because exploitation requires local access with network administration privileges in a multi-tenant namespace environment, and impact is confined to information exposure and functional disruption of IPsec state migrations. In standard deployments, this condition only manifests when independent network namespaces run IPsec services utilizing MOBIKE or XFRM migration mechanisms. Because migration multicast events are inadvertently forwarded to the host namespace rather than the originating container namespace, tunnel endpoint details may be exposed across isolation boundaries, and child namespace daemons fail to receive critical state updates. This flaw does not provide privilege escalation or direct system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.