Linux kernel (net/xfrm): Structure padding in the xfrm algorithm and encapsulation templates was copied to userspace

Impact

Structure padding in the xfrm algorithm and encapsulation templates was copied to userspace without being zeroed, so every SA dump hands out whatever was in those slab bytes. Small but reliable kernel-memory disclosure from inside a namespace.

Who can reach it

XFRM_MSG_GETSA / policy dumps over xfrm netlink, requiring CAP_NET_ADMIN in the network namespace - which a container granted NET_ADMIN with its own netns has. No fabric access needed; this is a container-to-host information leak.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers.

References