Linux kernel (net/xfrm): SA deletion decided whether to unhash from the by-SPI and by-sequence chains using field

Impact

SA deletion decided whether to unhash from the by-SPI and by-sequence chains using field values rather than actual list membership, so a state can be unlinked twice or left linked after free. The reporter clusters nine distinct KASAN signatures on the same slab object, including out-of-bounds and use-after-free writes reached from SA lookup and SPI allocation. That is a corruptible kernel heap object sitting on the IPsec state hash chains, which are walked by the packet decrypt path.

Who can reach it

Needs the ability to churn xfrm states - create, allocate SPIs for, and delete SAs concurrently. That is host root or a tenant container with CAP_NET_ADMIN in its own user+network namespace; the syzkaller reproduction runs entirely from netlink. The corrupted chains are the same ones __xfrm_state_lookup walks for every inbound ESP packet, so a peer sending fabric traffic can help land the freed object on a hot path.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published; the report is against 6.12.y stable and reproduces on mainline). Interim control: deny CAP_NET_ADMIN in tenant user namespaces so tenants cannot drive the SA create/delete churn.

References

Related entries

• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High