In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node
    comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed
    deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard
    lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of
    the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining
    deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds
    inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an
    evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket
    (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-
    path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style
    attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key
    (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr,
    key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout
    and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction
    gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash)
    once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
    (CVE-2026-90110)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer     entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk     the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can     predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack     candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered     when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted     inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-     limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel     primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports     (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using     SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in     the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external     entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking     the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and     compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at     every step of the RB-tree walk. (CVE-2026-90110)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365220	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
472595	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Cloud Security	Google COS Security Checks	Local	critical
472595	Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
467595	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Cloud Security	Google COS Security Checks	Local	critical
467595	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347515	Linux Distros Unpatched Vulnerability : CVE-2026-90110	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-90110

critical

Tenable Plugins

medium

medium

high

critical

critical

high

critical

critical

high

critical