Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after it

Impact

Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after it was cancelled, so the work can fire against a struct net that has already been freed and reallocated - a use-after-free in the host kernel driven by ordinary namespace teardown.

Who can reach it

Any workload that creates a network namespace, installs SAs with NAT keepalive, and exits - i.e. every pod delete on a node where containers hold CAP_NET_ADMIN in a user namespace and run IPsec. The race is between cleanup_net rounds, so high netns churn (normal Kubernetes behaviour) widens the window. Conditional on NAT-T keepalives being in use.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers so per-tenant SAs with keepalives cannot be created, or disable NAT keepalives where NAT is not in the path.

References

Related entries

• Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global systemCVE-2026-31516 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using fieldCVE-2026-46116 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High