CVE-2026-63914

In the Linux kernel, the following vulnerability has been resolved:

xfrm: route MIGRATE notifications to caller's netns

xfrmsendmigrate() in net/xfrm/xfrmuser.c and pfkeysendmigrate() in net/key/afkey.c both hardcode &initnet for the multicast that announces a successful XFRMMSGMIGRATE / SADBX_MIGRATE.

XFRMMSGMIGRATE arrives on a per-netns NETLINKXFRM socket, and the rest of the xfrm/afkey netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrmuser.c route their event using xsnet(x), xpnet(xp) or socknet(skb->sk); only the migrate path was missed.

Two consequences of the init_net hardcoding:

1. The notification (selector, old/new endpoint addresses, and the kmaddress) is delivered to listeners on initnet's XFRMNLGRPMIGRATE / pfkey BROADCASTALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host.

2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken.

Thread struct net through kmmigrate() and the xfrmmgr.migrate function pointer, drop the &initnet override in xfrmsendmigrate() and pfkeysendmigrate(), and pass the caller's net (already in scope in xfrmmigrate() via socknet(skb->sk)) all the way down. struct xfrmmgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal.

pfkeybroadcast() is already netns-aware via netgeneric(net, pfkeynetid) since the pernet conversion. The five other pfkeybroadcast() callers in afkey.c already pass xsnet(x), socknet(sk) or a per-netns net, so this only removes the &init_net outlier.