Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyte

Impact

An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyte memset past the end of a socket buffer. In practice that is instant kernel heap destruction and a node panic; with more care over the SA parameters it is a controllable kernel write, i.e. a path from a tenant container to full host compromise on a shared GPU node.

Who can reach it

Reachable by any principal that can install an xfrm state: host root, or - as the upstream report describes - a 'nobody' user inside a container that holds CAP_NET_ADMIN in its own user+network namespace, which is normal for CNI plugins, VPN sidecars and any pod running with NET_ADMIN. The recipe is entirely local: add an IPv4 ESP tunnel SA with a long truncated auth key, set a tiny interface MTU and a large XFRMA_TFCPAD, then send one UDP datagram. No fabric access and no cooperating peer are needed.

What to do

Boot a kernel carrying the fix commits below (the CVE record publishes no fixed stable version, so match by commit against your vendor kernel). Interim control: stop granting CAP_NET_ADMIN inside tenant user namespaces, and block the XFRM netlink family from tenant workloads that do not genuinely need to program IPsec.

References

Related entries

• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Several error paths in the ESP-in-TCP receive code return without freeing the skb, soCVE-2025-38057 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Xfrm_alloc_spi could hand out an SPI that is already in use by another inbound SA, because theCVE-2025-39797 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path intoCVE-2026-31472 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makesCVE-2026-31517 · Linux kernel (net/xfrm)High