Linux kernel (net/xfrm): Several error paths in the ESP-in-TCP receive code return without freeing the skb, so

Impact

Several error paths in the ESP-in-TCP receive code return without freeing the skb, so malformed or failing frames leak socket buffers. A peer that keeps feeding the error path drains kernel memory on the node until the OOM killer starts taking tenant workloads with it.

Who can reach it

Remote, driven by whatever can reach the espintcp encapsulation socket (TCP port 4500 by default) on a node using ESP-in-TCP encapsulation for IPsec through NAT/middleboxes. Conditional: only nodes with espintcp configured are affected; plain UDP-encapsulated or raw ESP setups are not.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop ESP-in-TCP encapsulation if it is not required, or firewall the espintcp port to known IKE peers only.

References