Linux kernel (net/xfrm): An SA created with an AF_UNSPEC selector escaped prefix-length validation, and the kernel then

Impact

An SA created with an AF_UNSPEC selector escaped prefix-length validation, and the kernel then copied the SA's own family (AF_INET) into the selector - leaving an IPv4 selector claiming a 128-bit prefix. Selector matching afterwards compares more address bits than exist, so which traffic that SA claims is undefined: the wrong flows can be steered into, or excluded from, an encrypted association.

Who can reach it

XFRM_MSG_NEWSA over xfrm netlink, which needs CAP_NET_ADMIN in the network namespace - satisfied by the node's IKE daemon and by any container granted NET_ADMIN with its own netns. A tenant with that capability can install selectors the validator was supposed to reject.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers so only the node's IKE daemon can install SAs, and audit installed selectors for prefix lengths that exceed the address family.

References