Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global system

Impact

An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global system workqueue, and the callback recovers its enclosing namespace by pointer arithmetic with nothing holding that namespace alive. Teardown before the work runs leaves the policy-hash rebuild operating on freed namespace memory. Because the attacker chooses both halves - queue the work, then destroy the namespace - this is a controllable use-after-free on freed kernel objects, i.e. a container-to-host escalation primitive.

Who can reach it

Deterministic from a tenant container that holds CAP_NET_ADMIN in its own user+network namespace: send XFRM_MSG_NEWSPDINFO to set policy hash thresholds, then immediately exit the namespace, and repeat. Existing teardown only flushes the policy hash work, not this one. No fabric access, no host root, no device node.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: deny CAP_NET_ADMIN inside tenant user namespaces, and where possible disable unprivileged user namespaces so tenants cannot create the namespaces to destroy.

References