CVE-2026-68294

A flaw was found in the Linux kernel's QRTR (Qualcomm IPC Router) networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages to QRTR sockets in other network namespaces. This bypasses network namespace isolation, enabling unauthorized communication and potential information disclosure between isolated network environments.

Red Hat has rated this vulnerability as having an Important severity because it allows unprivileged local users to break network namespace isolation, undermining boundary guarantees critical to containerized environments. While the Qualcomm IPC Router subsystem is primarily intended for specialized hardware such as modems and is rarely utilized in standard enterprise deployments, the socket family can be instantiated locally by unprivileged callers. This enables an attacker within an isolated namespace to intercept or inject control-plane traffic across namespaces, threatening system data confidentiality and service integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the qrtr kernel module from loading. Create a file /etc/modprobe.d/blacklist-qrtr.conf with the content blacklist qrtr. A system reboot is required for this change to take effect. This may impact functionality that relies on the QRTR inter-process communication mechanism, such as communication with modems or other remote processors.