Linux kernel mlx5_core MACsec offload: TENANT ISOLATION: deleting an offloaded MACsec RX secure channel frees

Impact

TENANT ISOLATION: deleting an offloaded MACsec RX secure channel frees the per-SC metadata_dst with a call that ignores the reference count, while the RX datapath is concurrently taking a reference on it under RCU - a use-after-free reachable from the packet path. The kernel CNA notes it is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root, so this is a container-to-host kernel corruption on nodes doing link-layer encryption.

Who can reach it

A tenant with an SR-IOV VF, a container with network-namespace capability, or a local user in a user namespace - combined with MACsec RX secure channel churn on an mlx5 interface.

What to do

Upgrade the host kernel to 7.2 or a stable backport (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5). Rolling reboot. Interim: restrict unprivileged user namespaces and do not delegate MACsec configuration into tenant namespaces.

References