Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and a

Impact

Policy deletion dropped the policy lock before pruning the inexact-policy bin, and a concurrent policy-hash rebuild can free that bin in the gap. The delete then walks and prunes freed memory - a use-after-free in the structure that decides which IPsec policy a flow matches. Corrupting the inexact policy tables is the worst place to get memory damage in this subsystem, because the same tables decide whether a tenant's traffic is encrypted at all.

Who can reach it

Two concurrent netlink operations, both of which need CAP_NET_ADMIN: XFRM_MSG_DELPOLICY on one thread and XFRM_MSG_NEWSPDINFO on another. A tenant container holding CAP_NET_ADMIN in its own user+network namespace can run both in a tight loop against its own policy set; no fabric access and no host root are required. The upstream commit publishes the exact interleaving.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: remove CAP_NET_ADMIN from tenant user namespaces so tenant workloads cannot issue XFRM policy netlink at all.

References