Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches the

Impact

Xfrm_selector_match() compared selectors without checking that the selector family matches the flow family or that the prefix length fits the address size. An AF_UNSPEC selector carrying a 128-bit prefix length matched against an IPv4 flow shifts out of bounds and reads off the stack. Beyond the memory-safety read, this is a policy-matching bug: a selector can be made to match flows it has no business matching, which is how one tenant's IPsec policy ends up deciding whether another tenant's traffic is encrypted, dropped, or sent in clear.

Who can reach it

Reachable by any principal that can install an xfrm policy and then send a packet - host root, or a tenant container holding CAP_NET_ADMIN in its own user+network namespace, which is common for pods running a CNI or VPN sidecar. The syzbot reproducer is a policy add with an AF_UNSPEC selector plus ordinary traffic; no fabric peer and no device node are involved.

What to do

Update to 5.10.261 / 5.15.212 / 6.1.178 / 6.6.145 or later on those stable series, or a vendor kernel carrying the fix commits below. Interim control: do not grant CAP_NET_ADMIN inside tenant user namespaces, and audit installed policies for AF_UNSPEC selectors with oversized prefix lengths.

References