Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's control

Impact

Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's control block and dereferences it later from a deferred workqueue callback, without ever taking a reference. If the namespace is destroyed between queueing and the callback, the IPsec receive path runs against freed namespace state - a use-after-free driven by inbound encrypted traffic on a node where tenant namespaces come and go, which is every hour of every day in a container fleet.

Who can reach it

Two ingredients, both cheap on a multi-tenant node: inbound ESP traffic in transport mode that takes the deferred reinjection path (async crypto), and a network namespace being torn down. A tenant supplies both itself - keep a peer sending encrypted traffic into its namespace, then exit the namespace - and normal pod churn supplies the second half by accident. Reachable from the fabric side by any peer that can send ESP transport-mode packets to the node.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: prefer tunnel mode over transport mode for tenant-facing SAs, and disable async/offloaded crypto so reinjection is not deferred, until nodes can be rebooted.

References