Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path into

Impact

One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path into an infinite loop in softirq context. The CPU never leaves the loop, so a single packet takes a core out permanently and wedges packet processing on the node - a fabric-wide stall and an outage for every tenant sharing that host, from one packet, repeatable at will.

Who can reach it

The malformed header is inside the decrypted IPTFS payload, so the sender must be a valid peer on the SA - a peer node on the cluster fabric, a compromised node, or a tenant endpoint terminating an overlay tunnel whose key the tenant holds. Conditional on IPTFS mode being configured. No local access to the victim node is required; the inner header never reaches ip_rcv_core, which is where this validation normally happens.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published in the record). Interim control: stop terminating tenant-controlled or untrusted IPTFS tunnels on shared nodes, and drop IP-TFS mode in favour of plain ESP tunnel mode until patched.

References