Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using field

Impact

SA deletion decided whether to unhash from the by-SPI and by-sequence chains using field values rather than actual list membership, so a state can be unlinked twice or left linked after free. The reporter clusters nine distinct KASAN signatures on the same slab object, including out-of-bounds and use-after-free writes reached from SA lookup and SPI allocation. That is a corruptible kernel heap object sitting on the IPsec state hash chains, which are walked by the packet decrypt path.

Who can reach it

Needs the ability to churn xfrm states - create, allocate SPIs for, and delete SAs concurrently. That is host root or a tenant container with CAP_NET_ADMIN in its own user+network namespace; the syzkaller reproduction runs entirely from netlink. The corrupted chains are the same ones __xfrm_state_lookup walks for every inbound ESP packet, so a peer sending fabric traffic can help land the freed object on a hot path.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published; the report is against 6.12.y stable and reproduces on mainline). Interim control: deny CAP_NET_ADMIN in tenant user namespaces so tenants cannot drive the SA create/delete churn.

References