Linux kernel (net/xfrm): If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cache

Impact

If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cache jumps to the found label while the acquire path is entered with an uninitialized state_ptrs structure. The SA selection path then works off stack garbage - a wild-pointer read/write in the code that decides which security association a flow gets, which is both a corruption primitive and a wrong-SA risk.

Who can reach it

Driven by any outbound flow that needs an SA on an IPsec-enabled node - tenant traffic on an encrypted overlay is enough; the race needs preemption between the cache lookup and the acquire branch, which ordinary scheduling on a busy node provides. Requires the per-CPU xfrm state cache (6.7 and later kernels) and configured xfrm policy.

What to do

Update to 6.12.41 or later in the 6.12 series, or a kernel carrying the linked stable commits. Interim: no meaningful workaround short of disabling IPsec on the node.

References