Linux kernel (net/xfrm): Xfrm_alloc_spi could hand out an SPI that is already in use by another inbound SA, because the

Impact

Xfrm_alloc_spi could hand out an SPI that is already in use by another inbound SA, because the uniqueness check hashed on destination address as well as SPI. Two live inbound SAs then share an SPI and inbound lookup returns an arbitrary one of them, so ESP packets are matched against the wrong security association - wrong keys, wrong policy, wrong peer attribution. This is an encryption-attribution break with no memory corruption involved: traffic is decrypted (or dropped) under an SA that belongs to someone else.

Who can reach it

Reached through XFRM_MSG_ALLOCSPI, issued by the node's IKE daemon (strongSwan/libreswan) or by any process with CAP_NET_ADMIN in its network namespace, which includes containers granted NET_ADMIN. It is deterministic when the configured SPI range is narrow (charon spi_min/spi_max) and probabilistic but real on any node carrying many child SAs - the shape of a per-tenant IPsec overlay where each tenant pair gets its own SA.

What to do

Boot a kernel carrying the linked stable commits, and pair it with the follow-up fix for SPI 0 (CVE-2025-39965) which the same change introduced. Interim: widen the IKE daemon's SPI range so collisions are far less likely, and audit for duplicate inbound SPIs with 'ip xfrm state' on nodes running many SAs.

References

Related entries

• Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path intoCVE-2026-31472 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makesCVE-2026-31517 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Outbound policies rejected optional tunnel and BEET templates but never got the same check forCVE-2026-68420 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esnCVE-2023-53147 · Linux kernel (net/xfrm)Medium
• Linux kernel (net/xfrm): An SA created with an AF_UNSPEC selector escaped prefix-length validation, and the kernel thenCVE-2024-50142 · Linux kernel (net/xfrm)Medium