Linux kernel (net/tls): The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device it

Impact

The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device it hands to the NIC offload path can be freed underneath it - a use-after-free on the device object reached from a plain setsockopt call.

Who can reach it

Any unprivileged socket owner enabling kTLS NIC offload: setsockopt(SOL_TLS, TLS_TX/TLS_RX, ...) on a socket whose route or lower device is changing (bonding failover, link churn, veth teardown). This is the exact configuration used for offloaded storage and control-plane TLS on ConnectX-class NICs, so it is live on nodes that lean on kTLS offload.

What to do

Boot a kernel carrying the linked stable commits. Interim: disable kTLS device offload (ethtool -K <dev> tls-hw-tx-offload off / tls-hw-rx-offload off) so the software path is used, and avoid link churn on nodes with live kTLS offload sessions.

References