Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global system

Impact

An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global system workqueue, and the callback recovers its enclosing namespace by pointer arithmetic with nothing holding that namespace alive. Teardown before the work runs leaves the policy-hash rebuild operating on freed namespace memory. Because the attacker chooses both halves - queue the work, then destroy the namespace - this is a controllable use-after-free on freed kernel objects, i.e. a container-to-host escalation primitive.

Who can reach it

Deterministic from a tenant container that holds CAP_NET_ADMIN in its own user+network namespace: send XFRM_MSG_NEWSPDINFO to set policy hash thresholds, then immediately exit the namespace, and repeat. Existing teardown only flushes the policy hash work, not this one. No fabric access, no host root, no device node.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: deny CAP_NET_ADMIN inside tenant user namespaces, and where possible disable unprivileged user namespaces so tenants cannot create the namespaces to destroy.

References

Related entries

• Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using fieldCVE-2026-46116 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High