Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyte

Impact

An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyte memset past the end of a socket buffer. In practice that is instant kernel heap destruction and a node panic; with more care over the SA parameters it is a controllable kernel write, i.e. a path from a tenant container to full host compromise on a shared GPU node.

Who can reach it

Reachable by any principal that can install an xfrm state: host root, or - as the upstream report describes - a 'nobody' user inside a container that holds CAP_NET_ADMIN in its own user+network namespace, which is normal for CNI plugins, VPN sidecars and any pod running with NET_ADMIN. The recipe is entirely local: add an IPv4 ESP tunnel SA with a long truncated auth key, set a tiny interface MTU and a large XFRMA_TFCPAD, then send one UDP datagram. No fabric access and no cooperating peer are needed.

What to do

Boot a kernel carrying the fix commits below (the CVE record publishes no fixed stable version, so match by commit against your vendor kernel). Interim control: stop granting CAP_NET_ADMIN inside tenant user namespaces, and block the XFRM netlink family from tenant workloads that do not genuinely need to program IPsec.

References