Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context while

Impact

When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context while sockets were still pointing at it. If the link comes back and the connection resumes after TCP retransmits, the kernel dereferences the freed context - a use-after-free driven by nothing more exotic than a link flap on a node carrying offloaded TLS connections. This is the offload-to-software fallback seam, and on a cluster fabric link flaps are routine rather than exceptional.

Who can reach it

No attacker privilege on the node is required. Any tenant or platform connection using NIC-offloaded kTLS is enough; the trigger is a netdev down/up transition (link flap, driver reset, ethtool reconfiguration, switch-side event) with live offloaded connections, followed by data resuming after retransmission. A peer on the fabric can help by keeping the connection alive across the flap. Conditional on TLS device offload actually being enabled on the NIC - check ethtool's tls-hw-tx-offload / tls-hw-rx-offload features.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published; this is old enough that most maintained kernels already carry it - verify rather than assume). Interim control: disable kTLS NIC offload with ethtool (tls-hw-tx-offload off, tls-hw-rx-offload off) so kTLS runs in software and the offload teardown path is never taken.

References