espintcp: remove encap socket caching to avoid reference leak
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.2%
probabilidad de explotación
0.2%top 95% de las CVE
explotación observada
noninguna fuente lo reporta
In the Linux kernel, the following vulnerability has been resolved:
espintcp: remove encap socket caching to avoid reference leak
The current scheme for caching the encap socket can lead to reference
leaks when we try to delete the netns.
The reference chain is: xfrm_state -> enacp_sk -> netns
Since the encap socket is a userspace socket, it holds a reference on
the netns. If we delete the espintcp state (through flush or
individual delete) before removing the netns, the reference on the
socket is dropped and the netns is correctly deleted. Otherwise, the
netns may not be reachable anymore (if all processes within the ns
have terminated), so we cannot delete the xfrm state to drop its
reference on the socket.
This patch results in a small (~2% in my tests) performance
regression.
A GC-type mechanism could be added for the socket cache, to clear
references if the state hasn't been used "recently", but it's a lot
more complex than just not caching the socket.
Productos afectados
Linux · LinuxReferencias
https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07https://git.kernel.org/stable/c/b58a295d10065960bcb9d60cb8ca6ead9837cd27https://git.kernel.org/stable/c/e4cde54b46a87231c77256a633be1bef62687d69https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html