Linux Kernel Out-of-Bounds Read Vulnerability in xfrm State Management

A vulnerability allowing an out-of-bounds read has been identified in the Linux kernel's xfrm state management. This issue arises during the lookup and resize operations, which can execute concurrently. The xfrm_state_hash_generation seqlock is intended to ensure consistency by forcing a retry, but the hash functions can encounter a hmask value that exceeds the capacity of the new hlist array. This inconsistency can lead to improper state lookups, creating a potential for memory access errors.

Impact

Exploitation of this vulnerability could lead to memory corruption by allowing an out-of-bounds read, which could be leveraged to read sensitive information or cause a denial-of-service condition by crashing the system.