Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skb

Impact

Async ESP resumption holds a reference on the original skb->dev, but the receive callback swaps skb->dev to the tunnel device without taking one. The resumption then drops a reference it never took - use-after-free on the tunnel netdevice plus a permanent refcount leak on the original device, so the node both corrupts memory and can never unregister the interface.

Who can reach it

Remote and packet-driven: inbound ESP that goes through async crypto (hardware or async software AEAD) and lands on a vti/xfrm tunnel device. Any peer on the fabric sending ESP to the node reaches it - no local access, no device node. Conditional on tunnel devices with an rcv_cb (vti/vti6/xfrmi) and async crypto being in use, which is the normal shape for offloaded IPsec on smart NICs.

What to do

Update to 6.19.x / 6.20 or later, or a kernel carrying the linked stable commits. Interim: disable IPsec crypto offload (ip xfrm state ... without offload, or ethtool -K <dev> esp-hw-offload off) so the synchronous path is used, and avoid vti-style tunnel devices on affected nodes.

References