Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and the

Impact

The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and the receive callback then dereferences it - KASAN reports a wild access at 0x6b6b6b6b in xfrmi_rcv_cb while handling an inbound ESP packet. An attacker who can make inbound state lookup fail gets the node reading attacker-influenced freed memory in the ESP receive path.

Who can reach it

Remote and pre-authentication: an ESP packet from anywhere on the fabric that hits a misconfigured or mismatched input state is enough - the report reproduces it with a plain ping over an xfrm interface. No local access, no device node, no valid SA required, since the trigger is precisely the failed-state path.

What to do

Boot a kernel carrying the linked stable commits. Interim: filter ESP to known peer addresses at the node's ingress so unmatched inbound SPIs never reach xfrm_input.

References