Linux kernel (net/core, net/tls): The bitmap that marks sk_msg scatterlist entries as externally owned was not carried

Impact

The bitmap that marks sk_msg scatterlist entries as externally owned was not carried along when entries are shifted, split, transferred or compacted - including the partial tail entry produced when kTLS splits an open record. An entry backed by a splice-supplied page-cache page can therefore arrive in a new slot with its ownership bit clear, at which point a sockmap BPF verdict is handed the page as writable program data. Writes then land in the shared page cache: file contents belonging to other workloads on the node get modified through what should be a read-only zero-copy reference.

Who can reach it

Requires a sk_msg/sockmap BPF program attached on the node - a service mesh or CNI datapath (Cilium and similar), not something a tenant can attach itself - and a socket doing splice or sendfile-style zero-copy, with kTLS in the mix for the open-record-split variant. The corrupted target is the page cache, which is shared across every tenant on the host, so the blast radius crosses the tenant boundary even though the trigger sits in the platform's own datapath. Say plainly: the tenant is the victim here more often than the attacker, unless tenants can influence what the mesh's BPF program writes.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable sk_msg/sockmap acceleration in the service mesh or CNI (Cilium's socket-level load balancing and sockops redirection) on nodes carrying shared file-backed data until patched.

References