CVE-2026-90110

A flaw was found in the Linux kernel's inetpeer rate limiting system. An off-path attacker could exploit a deterministic Red-Black tree traversal mechanism to predict the tree's structure and force the eviction of specific network peer entries. This manipulation allows the attacker to reset rate-limiting token buckets, enabling them to bypass IP-keyed ICMP rate limits and potentially infer open UDP ports through a side-channel attack.

The inetpeer rate limiting cache used deterministic RB tree ordering based on remote IP addresses, which made lookup paths and garbage collection candidate selection predictable to an off path network attacker. By forcing inet_peer garbage collection and selective eviction, an attacker could cause selected peer entries to be recreated with a fresh token bucket and bypass IP keyed ICMP rate limits. This creates a network side channel that can be used to infer UDP port state, similar to SAD DNS style attacks. For the CVSS the PR:N is used because the attacker does not need local code execution or an authenticated user context on the target, only network reachability and the ability to send crafted traffic patterns. The issue is network reachable but has high attack complexity because reliable use depends on shaping the peer cache, triggering garbage collection, and observing rate limit effects. Impact is mainly limited confidentiality loss and security feature bypass, with possible limited integrity relevance as an auxiliary primitive for UDP spoofing attacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.