Linux kernel (net/xfrm): When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from the

Impact

When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from the list but the list head's tail pointer still points at it. The generic transmit path then writes through that pointer into memory the crypto engine already owns and may have freed - a use-after-free write in the normal egress path of every encrypted flow on the node. This is corruption on the send side of fabric encryption, so it damages whatever the slab hands out next, across tenants.

Who can reach it

Triggered by ordinary large (GSO) traffic leaving a node through an IPsec-offloaded device whenever the async crypto path claims the final segment. Conditional on IPsec offload being enabled (hardware or async software crypto engine). Any tenant that can generate bulk TCP egress over the encrypted fabric drives the condition; nothing privileged is required and no attacker-supplied packet content is needed, which also makes it fire on its own under load.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable IPsec crypto offload on the NIC (turn off the esp-hw-offload feature with ethtool, or drop XFRM_OFFLOAD from SA configuration) so segments are not stolen asynchronously.

References