Linux kernel (net/xfrm): An SA created with an AF_UNSPEC selector escaped prefix-length validation, and the kernel then

Impact

An SA created with an AF_UNSPEC selector escaped prefix-length validation, and the kernel then copied the SA's own family (AF_INET) into the selector - leaving an IPv4 selector claiming a 128-bit prefix. Selector matching afterwards compares more address bits than exist, so which traffic that SA claims is undefined: the wrong flows can be steered into, or excluded from, an encrypted association.

Who can reach it

XFRM_MSG_NEWSA over xfrm netlink, which needs CAP_NET_ADMIN in the network namespace - satisfied by the node's IKE daemon and by any container granted NET_ADMIN with its own netns. A tenant with that capability can install selectors the validator was supposed to reject.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers so only the node's IKE daemon can install SAs, and audit installed selectors for prefix lengths that exceed the address family.

References

Related entries

• Linux kernel (net/xfrm): The async-event reply buffer was sized without accounting for the interface-ID attribute, soCVE-2026-43107 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): Tearing down an IPTFS security association cancels its hrtimers while holding the very locksCVE-2026-53197 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): The policy-hash rebuild preallocates for exactly the wrong half of the policy set - the guardCVE-2026-64579 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): Transmitting a packet carrying a metadata dst (no dstCVE-2022-50004 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): Transport-mode IPsec packets were reinjected in the same execution context instead of beingCVE-2022-50445 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): Structure padding in the xfrm algorithm and encapsulation templates was copied to userspaceCVE-2023-53684 · Linux kernel (net/xfrm)Medium