Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and the

Impact

The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and the receive callback then dereferences it - KASAN reports a wild access at 0x6b6b6b6b in xfrmi_rcv_cb while handling an inbound ESP packet. An attacker who can make inbound state lookup fail gets the node reading attacker-influenced freed memory in the ESP receive path.

Who can reach it

Remote and pre-authentication: an ESP packet from anywhere on the fabric that hits a misconfigured or mismatched input state is enough - the report reproduces it with a plain ping over an xfrm interface. No local access, no device node, no valid SA required, since the trigger is precisely the failed-state path.

What to do

Boot a kernel carrying the linked stable commits. Interim: filter ESP to known peer addresses at the node's ingress so unmatched inbound SPIs never reach xfrm_input.

References

Related entries

• Linux kernel (net/xfrm): SA lookup can observe the new hash mask before the new bucket array is published, so itCVE-2024-57982 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink putsCVE-2025-38500 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cacheCVE-2025-38675 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High