Linux kernel (net/xfrm): The async-event reply buffer was sized without accounting for the interface-ID attribute, so

CVSS 6.5CVE-2026-43107Kernel, userspace & hypervisorcurated

Impact

The async-event reply buffer was sized without accounting for the interface-ID attribute, so querying an SA that has an if_id set overflows the reply skb, returns -EMSGSIZE, and lands on a BUG_ON - a deterministic kernel panic from a single netlink query. One tenant with namespace-scoped network privilege takes the whole node down and every co-tenant loses its GPUs.

Who can reach it

Needs an xfrm netlink socket and an SA carrying an if_id, then one XFRM_MSG_GETAE request. That is host root or, more interestingly, a tenant container holding CAP_NET_ADMIN in its own user+network namespace: it can create its own SA with an if_id and immediately query it, so it does not depend on the host's SA configuration at all. No fabric access needed.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: remove CAP_NET_ADMIN from tenant user namespaces, or block the XFRM netlink family for tenant workloads - there is no way to make the panic survivable once the request reaches the kernel.

References

https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43 https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c https://nvd.nist.gov/vuln/detail/CVE-2026-43107

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.