Linux kernel sockmap: vsock or AF_UNIX socket in a sockmap faults in tls_sw_ctx_rx

Impact

After sockmap gained vsock and AF_UNIX support, tls_sw_has_ctx_tx/rx still assumed every socket handed to it was an inet_connection_sock. For a vsock_sock or unix_sock, tls_get_ctx() returns a bogus pointer and the kernel takes an unhandled page fault in sk_psock_strp_data_ready(), as in the reported vsock-loopback trace. This matters where sockmap is actually in production - Cilium-style service mesh and socket-level load balancing on the fleet - because the fault lands in softirq/workqueue context and takes the node down with every GPU job on it. Availability only; no data disclosure is described.

Who can reach it

Local: a process able to add a vsock or AF_UNIX socket to a sockmap, which means a privileged agent or a workload granted BPF map access, on a kernel with sockmap+kTLS in use. Not reachable without sockmap configured.

What to do

Update to a stable kernel with the sk_is_inet()/IS_ICSK check (linked commits) and reboot the node. As an interim measure, do not place vsock or AF_UNIX sockets into sockmaps. No vendor fixed-version string is present in the record - the fix landed around 6.12 stable plus backports.

References

Related entries

• Linux kernel RDMA/siw: slab pages passed to MSG_SPLICE_PAGES trip a skb_splice_from_iter warningCVE-2024-53094 · Linux kernel RDMA/siw (software iWARP transmit path, MSG_SPLICE_PAGES)Medium
• Linux kernel io_uring: unchecked user address overflow in io_pin_pages during ring setupCVE-2024-53187 · Linux kernel io_uring (io_pin_pages address + size overflow)Medium
• Linux kernel KVM arm64: mismanaged userspace irqchip state triggers a kernel WARN on vCPU re-initCVE-2024-53195 · Linux kernel KVM on arm64 (arch_timer / userspace_irqchip_in_use)Medium
• Linux KVM x86 - hypercall completion for protected guests: KVM used the wrong helper to decide whether a hypercallCVE-2024-55881 · Linux KVM x86 - hypercall completion for protected guestsMedium
• Linux kernel sched/deadline: WARN_ON reachable by a local task when a PI-boosted task is requeuedCVE-2024-56583 · Linux kernel deadline scheduler (setup_new_dl_entity on PI-boosted tasks)Medium
• Linux kernel mm/mempolicy: NULL VMA deref in migrate_pages() crashes the host kernelCVE-2024-56611 · Linux kernel mm/mempolicy (do_migrate_pages / migrate_to_node)Medium