Executive brief
The Linux kernel's ESP-in-TCP implementation (used for encrypting traffic over TCP connections) can crash when processing queued data after a network device is removed, such as during virtual network interface or namespace teardown. An attacker on the network or with the ability to trigger device removal could cause a denial of service by crashing the kernel.
Technical details
The vulnerability is a null pointer dereference in the handle_esp() function in net/xfrm/espintcp.c. When ESP-in-TCP data is queued in the TCP strparser and processed after the original ingress device has been removed (e.g., during veth or network namespace teardown), dev_get_by_index_rcu() returns NULL. The subsequent XFRM IPv4 and IPv6 input paths attempt to use this NULL device pointer for route lookup, causing a kernel crash. The fix adds a check to drop packets when the ingress device can no longer be resolved, preventing the dereference. The vulnerability affects all kernel versions with ESP-in-TCP support and has been patched.
Affected products
- Linux Linux kernel All versions with ESP-in-TCP support (from commit e27cca96cd68 onwards)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched