Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. By sending a specifically crafted request to the kernel's IPsec management interface, an attacker can trigger a kernel panic, leading to a complete denial of service. This affects the stability and availability of servers and workstations running impacted versions of the Linux operating system.
Technical details
An incorrect buffer size calculation in the XFRM subsystem (specifically in xfrm_user.c) leads to a kernel panic. The function xfrm_get_ae() allocates a socket buffer (skb) using xfrm_aevent_msgsize(), which fails to account for the XFRMA_IF_ID attribute. When build_aevent() subsequently attempts to append this attribute, it may exceed the allocated buffer size, returning an -EMSGSIZE error. This error triggers a BUG_ON() call in xfrm_get_ae(), resulting in a kernel panic. The fix involves correctly accounting for the attribute size and replacing the BUG_ON() with proper error handling and resource cleanup. This is a local attack vector requiring low privileges to interact with Netlink.
Affected products
- Linux Linux Kernel 4.19 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-26: other: Patch authored
- 2026-05-06: disclosed
- 2026-05-06: advisory