Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a state

Impact

The IPsec input path validates a security association before taking the state lock, so a state that is killed in the window between the check and the insert still gets published into the per-CPU input cache. Later packets then resolve against a dead SA - traffic keeps being accepted and decrypted under credentials the control plane believes it has revoked, and the cached dead state is a use-after-free on the decrypt hot path. Revoking a tenant's SA stops meaning the tenant's traffic stops being accepted.

Who can reach it

The insertion happens on the packet input path, so it is driven by anyone who can send ESP traffic that resolves an SA on the node: a peer on the RDMA/IP fabric, another node, or a tenant terminating an overlay tunnel. The race partner is an ordinary SA deletion - exactly what an IKE daemon does on rekey or teardown, so the window opens on its own during normal rekey churn and can be widened by a peer forcing rekeys. No local access to the victim node is required.

What to do

Update to 6.12.97 or later on the 6.12 stable series, or a vendor kernel carrying the fix commits below. Interim control: none that is real - slowing SA rekey/teardown churn narrows the window but does not close it. Treat this as a mandatory reboot on any node running IPsec on the fabric.

References