Linux kernel (net/xfrm): XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esn

Impact

XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esn allocated, so the kernel memcpys into a NULL pointer. The commit is explicit that a malicious user can crash the kernel this way - a container-triggerable node panic straight through the replay-state update path.

Who can reach it

xfrm_new_ae over xfrm netlink, requiring CAP_NET_ADMIN in the network namespace - satisfied by any container granted NET_ADMIN with its own netns, and by the node's IKE daemon. No fabric access or device node needed; the SA does not need to be a valid ESN state, which is the whole point.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers so xfrm netlink is not reachable from tenant workloads.

References