Linux kernel mlx5_core IPsec RX offload: When hardware reports an xfrm state ID for a decrypted packet whose state

Impact

When hardware reports an xfrm state ID for a decrypted packet whose state has already been freed, the secpath extension is left attached with length zero and the policy check reads sp->xvec[-1], faulting the kernel. Any remote IPsec peer can crash a node doing hardware IPsec offload on ConnectX - relevant if you encrypt tenant traffic in flight across the fabric.

Who can reach it

Remote IPsec peer, unauthenticated with respect to this bug - the peer just needs to be in an SA that gets torn down while packets are in flight.

What to do

Upgrade the host kernel to 6.17 or a stable backport (6.6.102, 6.12.42, 6.15.10, 6.16.1). Rolling reboot of nodes doing IPsec offload. Interim: move IPsec off hardware offload to software xfrm (config change, CPU cost, no reboot).

References