Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socket

Impact

An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socket buffer, so the receive path trims and frees an skb that reassembly (or the drop timer) has already released. A remote peer that can keep two reassembly contexts in flight gets a use-after-free in the skbuff slab on the decrypt path - kernel heap corruption reachable from the encrypted fabric.

Who can reach it

Driven entirely by inbound ESP traffic on an IPTFS SA plus concurrency: the attacker only has to send interleaved partial IPTFS payloads so reassembly completes on one CPU while another is still in __input_process_payload. Reachable by any peer holding the SA - a peer node, a compromised node in the fleet, or the remote end of a tenant overlay. Conditional on IPTFS mode being configured; no tenant device node and no local privilege on the victim node needed.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable IP-TFS mode on cluster SAs, or blacklist xfrm_iptfs where it is not in use, so the reassembly path is not reachable at all.

References