Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socket

Impact

An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socket buffer, so the receive path trims and frees an skb that reassembly (or the drop timer) has already released. A remote peer that can keep two reassembly contexts in flight gets a use-after-free in the skbuff slab on the decrypt path - kernel heap corruption reachable from the encrypted fabric.

Who can reach it

Driven entirely by inbound ESP traffic on an IPTFS SA plus concurrency: the attacker only has to send interleaved partial IPTFS payloads so reassembly completes on one CPU while another is still in __input_process_payload. Reachable by any peer holding the SA - a peer node, a compromised node in the fleet, or the remote end of a tenant overlay. Conditional on IPTFS mode being configured; no tenant device node and no local privilege on the victim node needed.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable IP-TFS mode on cluster SAs, or blacklist xfrm_iptfs where it is not in use, so the reassembly path is not reachable at all.

References

Related entries

• Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's controlCVE-2026-63919 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): SA lookup can observe the new hash mask before the new bucket array is published, so itCVE-2024-57982 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink putsCVE-2025-38500 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cacheCVE-2025-38675 · Linux kernel (net/xfrm)High