CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event
In the Linux kernel, the following vulnerability has been resolved:
xfrm: always flush state and policy upon NETDEVUNREGISTER event
syzbot is reporting that "struct xfrmstate" refcount is leaking.
unregisternetdevice: waiting for netdevsim0 to become free. Usage count = 2 reftracker: netdev@ffff888052f24618 has 1/1 users at netdevtrackeralloc include/linux/netdevice.h:4400 [inline] netdevtrackeralloc include/linux/netdevice.h:4412 [inline] xfrmdevstateadd+0x3a5/0x1080 net/xfrm/xfrmdevice.c:316 xfrmstateconstruct net/xfrm/xfrmuser.c:986 [inline] xfrmaddsa+0x34ff/0x5fa0 net/xfrm/xfrmuser.c:1022 xfrmuserrcvmsg+0x58e/0xc00 net/xfrm/xfrmuser.c:3507 netlinkrcvskb+0x158/0x420 net/netlink/afnetlink.c:2550 xfrmnetlinkrcv+0x71/0x90 net/xfrm/xfrmuser.c:3529 netlinkunicastkernel net/netlink/afnetlink.c:1318 [inline] netlinkunicast+0x5aa/0x870 net/netlink/afnetlink.c:1344 netlinksendmsg+0x8c8/0xdd0 net/netlink/afnetlink.c:1894 socksendmsgnosec net/socket.c:727 [inline] socksendmsg net/socket.c:742 [inline] syssendmsg+0xa5d/0xc30 net/socket.c:2592 syssendmsg+0x134/0x1d0 net/socket.c:2646 syssendmsg+0x16d/0x220 net/socket.c:2678 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcd/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrmdevunregister() as no-op despite xfrmdevstateadd() from xfrmstateconstruct() acquires a reference to "struct netdevice". I guess that that commit expected that NETDEVDOWN event is fired before NETDEVUNREGISTER event fires, and also assumed that xfrmdevstateadd() is called only if (dev->features & NETIFFHWESP) != 0.
Sabrina Dubroca identified steps to reproduce the same symptoms as below.
echo 0 > /sys/bus/netdevsim/newdevice dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/deldevice
Like these steps indicate, the NETIFFHWESP bit can be cleared after xfrmdevstateadd() acquired a reference to "struct netdevice". Also, xfrmdevstateadd() does not check for the NETIFFHWESP bit when acquiring a reference to "struct netdevice".
Commit 03891f820c21 ("xfrm: handle NETDEVUNREGISTER for xfrm device") re-introduced the NETDEVUNREGISTER event to xfrmdevevent(), but that commit for unknown reason chose to share xfrmdevdown() between the NETDEVDOWN event and the NETDEVUNREGISTER event. I guess that that commit missed the behavior in the previous paragraph.
Therefore, we need to re-introduce xfrmdevunregister() in order to release the reference to "struct netdevice" by unconditionally flushing state and policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.128 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.75 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.16 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.6 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
Re-introduce xfrm_dev_unregister() and invoke it for NETDEV_UNREGISTER so XFRM state and policy are unconditionally flushed, releasing references to struct net_device.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Linux kernel packages are exposed when XFRM state or policy is associated with a network device that is later unregistered. The listed software includes Linux kernel builds for Ubuntu Azure, AWS FIPS, Azure FIPS, FIPS, GCP FIPS, GCP, and Oracle environments.
What access does an attacker need?
The vector is local and requires low privileges, with no user interaction required. The report shows the condition can be reached through XFRM netlink processing while adding security associations.
What is the practical impact?
The issue leaks references to XFRM state and network-device objects during device unregistration, which can prevent a network device from being freed. The stated security impact is availability only; no confidentiality or integrity impact is indicated.
What does the fix change?
The fix ensures that XFRM state and policy are always flushed when a NETDEV_UNREGISTER event occurs, preventing the retained references described in the report.