Re: [PATCH net v2 0/4] Mitigate a side channel in routing exception caches

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Fri, 28 Aug 2026 22:23:40 +0300 you wrote:

When an ICMP error that quotes a UDP packet is locally delivered, the
kernel only creates a routing exception if the quoted packet matches a
socket. This allows an off-path attacker to conduct a side-channel
attack on the routing exception caches in order to discover the
ephemeral ports used by connected UDP sockets.

Previous mitigations tried to make it harder for attackers to find hash
collisions in these caches and make the eviction of exceptions less
predictable. Amit Klein and Noam Caspi demonstrated that both of these
mitigations can be bypassed.

[...]

Here is the summary with links:
  - [net,v2,1/4] ipv6: Fix redirect exception creation for UDP/RAW sockets
    https://git.kernel.org/netdev/net/c/cd51b74bdd0b
  - [net,v2,2/4] ipv4: udp: Create exceptions before socket matching
    https://git.kernel.org/netdev/net/c/4c3499f79f8c
  - [net,v2,3/4] ipv6: udp: Create exceptions before socket matching
    https://git.kernel.org/netdev/net/c/ac76cab50e89
  - [net,v2,4/4] selftests: net: Add exception cache tests
    https://git.kernel.org/netdev/net/c/c923c14942b1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html