Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's control

CVSS 8.8CVE-2026-63919Kernel, userspace & hypervisorcurated

Impact

Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's control block and dereferences it later from a deferred workqueue callback, without ever taking a reference. If the namespace is destroyed between queueing and the callback, the IPsec receive path runs against freed namespace state - a use-after-free driven by inbound encrypted traffic on a node where tenant namespaces come and go, which is every hour of every day in a container fleet.

Who can reach it

Two ingredients, both cheap on a multi-tenant node: inbound ESP traffic in transport mode that takes the deferred reinjection path (async crypto), and a network namespace being torn down. A tenant supplies both itself - keep a peer sending encrypted traffic into its namespace, then exit the namespace - and normal pod churn supplies the second half by accident. Reachable from the fabric side by any peer that can send ESP transport-mode packets to the node.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: prefer tunnel mode over transport mode for tenant-facing SAs, and disable async/offloaded crypto so reinjection is not deferred, until nodes can be rebooted.

References

https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4 https://nvd.nist.gov/vuln/detail/CVE-2026-63919

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.