Database/Kernel, userspace & hypervisor
Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink puts
Impact
The guard that forbids changing a collect_md xfrm interface never fired, so a changelink puts the special interface into the per-netns hash while it is still referenced by the collect_md pointer. The netdevice is then freed twice when the namespace goes away - a kernel BUG and heap corruption in the host kernel, reached from inside a container's own network namespace.
Who can reach it
A container with CAP_NET_ADMIN in a user namespace and its own netns (the common configuration for CNI-managed pods and for anything running with NET_ADMIN) creates a collect_md xfrm interface via RTM_NEWLINK, then issues a changelink on it. The double free lands when that netns is torn down, which happens on every pod delete.
What to do
Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers, or block the xfrm interface link type (blacklist xfrm_interface) on nodes that do not need it.
References
Related entries
- Linux kernel (net/xfrm): If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cacheCVE-2025-38675 · Linux kernel (net/xfrm)High
- Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High
- Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
- Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High
- Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global systemCVE-2026-31516 · Linux kernel (net/xfrm)High
- Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using fieldCVE-2026-46116 · Linux kernel (net/xfrm)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.