Linux Kernel Net Namespace Handling Vulnerability in XFRM Module

A vulnerability in the Linux kernel's XFRM (IPsec transformation) module has been addressed. The issue involved improper management of network namespace references during deferred transport reinjection, which could lead to invalid memory access. The vulnerability was present in the stable branch of the Linux kernel.

Impact

The vulnerability could cause a use-after-free condition by allowing a reference to a network namespace to become invalid before it was used, potentially leading to memory corruption.

Reproduction

The vulnerability could be reproduced by queuing deferred reinjection work in the XFRM module without properly holding a reference to the network namespace. This could be done by using the 'xfrm_trans_queue_net' function to queue a packet for reinjection, while the network namespace is being torn down, allowing the 'net' pointer to become invalid before the reinjection callback is executed.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.