Linux kernel (net/xfrm): The async-event reply buffer was sized without accounting for the interface-ID attribute, so

Impact

The async-event reply buffer was sized without accounting for the interface-ID attribute, so querying an SA that has an if_id set overflows the reply skb, returns -EMSGSIZE, and lands on a BUG_ON - a deterministic kernel panic from a single netlink query. One tenant with namespace-scoped network privilege takes the whole node down and every co-tenant loses its GPUs.

Who can reach it

Needs an xfrm netlink socket and an SA carrying an if_id, then one XFRM_MSG_GETAE request. That is host root or, more interestingly, a tenant container holding CAP_NET_ADMIN in its own user+network namespace: it can create its own SA with an if_id and immediately query it, so it does not depend on the host's SA configuration at all. No fabric access needed.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: remove CAP_NET_ADMIN from tenant user namespaces, or block the XFRM netlink family for tenant workloads - there is no way to make the panic survivable once the request reaches the kernel.

References