Linux kernel (net/xfrm): The 32-bit compat translation of xfrm netlink attributes uses the attacker-supplied attribute

Impact

The 32-bit compat translation of xfrm netlink attributes uses the attacker-supplied attribute type as an array index after a bounds check that the CPU can speculate past. This is a Spectre v1 gadget in the xfrm netlink parser: architecturally safe, but speculatively it reads kernel memory outside the policy table and can leak it through a cache side channel.

Who can reach it

A 32-bit process sending xfrm netlink messages, needing CAP_NET_ADMIN in the network namespace - which a container granted NET_ADMIN with its own netns has, and CONFIG_COMPAT plus a 32-bit or compat-capable tenant binary. Turning the gadget into an actual leak requires a working speculation side channel, so treat this as a hardening gap rather than a directly weaponizable read.

What to do

Boot a kernel carrying the linked stable commits (which add array_index_nospec). Interim: drop CAP_NET_ADMIN from tenant containers, or build/boot without CONFIG_COMPAT on nodes that never run 32-bit workloads.

References