Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pages

Impact

IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pages are privately owned and decrypts in place over pages that are still referenced elsewhere - typically read-only page-cache pages. Inbound IPsec traffic therefore silently rewrites memory belonging to other work on the node: file cache corruption for any tenant on that host, and kernel panics once the damaged pages are used.

Who can reach it

Driven by inbound ESP traffic on an IPTFS-mode SA, so any peer that can put packets on the SA reaches it - a node-to-node encryption peer inside the cluster, a compromised node, or the far end of a tenant overlay tunnel. Conditional on IP-TFS mode being in use (CONFIG_XFRM_IPTFS / xfrm_iptfs loaded and an SA configured with mode iptfs). No tenant device node is required; a tenant on the far side of the tunnel or a compromised peer node is enough.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version is published in the record - match by commit with your distro kernel). Interim control: stop using IPTFS mode for node-to-node and tenant-overlay SAs and fall back to plain ESP tunnel mode until the fleet is patched.

References