Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an error

Impact

NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an error, including after the output path has already taken ownership and consumed it. Any send failure on a keepalive turns into a double free - kernel heap corruption on a node doing NAT-traversal IPsec.

Who can reach it

Remote-influenced rather than remote-executed: the keepalive timer runs on its own, and whether the send fails after handoff depends on network conditions an off-path party can shape (route loss, neighbour failure, MTU/ICMP responses). Conditional on NAT-T keepalives being configured on SAs, which is standard when IPsec crosses NAT or cloud gateways. No local privilege or device node needed.

What to do

Boot a kernel carrying the linked stable commits. Interim: disable NAT keepalives on SAs that do not need them (no NAT in the path), which removes the code path entirely.

References