Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a state

Impact

The IPsec input path validates a security association before taking the state lock, so a state that is killed in the window between the check and the insert still gets published into the per-CPU input cache. Later packets then resolve against a dead SA - traffic keeps being accepted and decrypted under credentials the control plane believes it has revoked, and the cached dead state is a use-after-free on the decrypt hot path. Revoking a tenant's SA stops meaning the tenant's traffic stops being accepted.

Who can reach it

The insertion happens on the packet input path, so it is driven by anyone who can send ESP traffic that resolves an SA on the node: a peer on the RDMA/IP fabric, another node, or a tenant terminating an overlay tunnel. The race partner is an ordinary SA deletion - exactly what an IKE daemon does on rekey or teardown, so the window opens on its own during normal rekey churn and can be widened by a peer forcing rekeys. No local access to the victim node is required.

What to do

Update to 6.12.97 or later on the 6.12 stable series, or a vendor kernel carrying the fix commits below. Interim control: none that is real - slowing SA rekey/teardown churn narrows the window but does not close it. Treat this as a mandatory reboot on any node running IPsec on the fabric.

References

Related entries

• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socketCVE-2026-53240 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's controlCVE-2026-63919 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): SA lookup can observe the new hash mask before the new bucket array is published, so itCVE-2024-57982 · Linux kernel (net/xfrm)High