Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink puts

Impact

The guard that forbids changing a collect_md xfrm interface never fired, so a changelink puts the special interface into the per-netns hash while it is still referenced by the collect_md pointer. The netdevice is then freed twice when the namespace goes away - a kernel BUG and heap corruption in the host kernel, reached from inside a container's own network namespace.

Who can reach it

A container with CAP_NET_ADMIN in a user namespace and its own netns (the common configuration for CNI-managed pods and for anything running with NET_ADMIN) creates a collect_md xfrm interface via RTM_NEWLINK, then issues a changelink on it. The double free lands when that netns is torn down, which happens on every pod delete.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers, or block the xfrm interface link type (blacklist xfrm_interface) on nodes that do not need it.

References