Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically while

Impact

Setting a per-socket IPsec policy reset the socket's destination cache non-atomically while the UDP transmit fast path resets the same field with an atomic exchange. Racing the two drops the single reference twice and frees the xfrm destination bundle while it is still in use. The upstream report shows a KASAN use-after-free write with a working exploit binary in the trace - a freed-object write primitive in the kernel, which on a shared GPU node means a tenant escaping its container onto the host.

Who can reach it

The commit states it plainly: reachable by an unprivileged user via a user+network namespace. Concretely, a tenant process creates a connected UDP socket, loops IP_XFRM_POLICY setsockopt against a concurrent sendmsg, and wins the race. No CAP_NET_ADMIN on the host, no fabric access, no device node - just an unprivileged process inside a container with unprivileged user namespaces enabled, which is the default on most container hosts.

What to do

Boot a kernel carrying the fix commits below (the version list in the record marks introduction points, not fixes - match by commit). Interim control: disable unprivileged user namespaces on shared nodes (kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0 for tenant cgroups), which removes the stated reachability path.

References