In the Linux kernel, the following vulnerability has been resolved:
xfrm: nat_keepalive: avoid double free on send error
nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6
send helper reports an error.
That cleanup is only correct before the skb is handed to the output
path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the
networking stack may already have consumed the skb before returning an
error, so freeing it again is unsafe.
Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4()
and nat_keepalive_send_ipv6(), where the caller still owns the skb, and
keep nat_keepalive_send() responsible only for family dispatch and the
unsupported-family cleanup path.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - On internet-facing IPsec VPN gateways using kernel NAT keepalive, a remote attacker can induce post-handoff outbound send failures (e.g., ENOMEM from network-driven memory pressure) when periodic keepalives are transmitted, reaching the vulnerable double-free path.
AC:L - After an outbound ESP-in-UDP SA has NAT keepalive configured, an attacker can reliably force send errors where the stack already consumed the skb (ip6_xmit EMSGSIZE, ip_finish_output2 neighbour/ENOMEM paths) without uncontrollable races or memory layout dependencies.
PR:N - Remote exploitation requires no privileges on the victim; it only needs a typical IPsec NAT-T deployment where userspace already set XFRMA_NAT_KEEPALIVE_INTERVAL. Local exploitation via user namespaces needs only CAP_NET_ADMIN (PR:L), not root in the init namespace.
UI:N - No victim or administrator interaction is needed during exploitation; NAT keepalives are sent automatically by the kernel delayed work queue on the configured interval once the XFRM SA exists.
S:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, container breakout, or IOMMU/DMA boundary bypass.
C:H - The skb double-free corrupts the slab allocator and yields use-after-free primitives that can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak or crash-only NULL dereference.
I:H - Double-free heap corruption enables attacker-controlled reallocation of freed sk_buff objects, supporting arbitrary kernel memory writes, control-flow hijacking, and local privilege escalation.
A:H - The double-free reliably causes slab corruption, kernel oops, or panic during keepalive send-error cleanup, providing immediate and repeatable denial of service on affected systems.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - On internet-facing IPsec VPN gateways using kernel NAT keepalive, a remote attacker can induce post-handoff outbound send failures (e.g., ENOMEM from network-driven memory pressure) when periodic keepalives are transmitted, reaching the vulnerable double-free path.
AC:L - After an outbound ESP-in-UDP SA has NAT keepalive configured, an attacker can reliably force send errors where the stack already consumed the skb (ip6_xmit EMSGSIZE, ip_finish_output2 neighbour/ENOMEM paths) without uncontrollable races or memory layout dependencies.
PR:N - Remote exploitation requires no privileges on the victim; it only needs a typical IPsec NAT-T deployment where userspace already set XFRMA_NAT_KEEPALIVE_INTERVAL. Local exploitation via user namespaces needs only CAP_NET_ADMIN (PR:L), not root in the init namespace.
UI:N - No victim or administrator interaction is needed during exploitation; NAT keepalives are sent automatically by the kernel delayed work queue on the configured interval once the XFRM SA exists.
S:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, container breakout, or IOMMU/DMA boundary bypass.
C:H - The skb double-free corrupts the slab allocator and yields use-after-free primitives that can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak or crash-only NULL dereference.
I:H - Double-free heap corruption enables attacker-controlled reallocation of freed sk_buff objects, supporting arbitrary kernel memory writes, control-flow hijacking, and local privilege escalation.
A:H - The double-free reliably causes slab corruption, kernel oops, or panic during keepalive send-error cleanup, providing immediate and repeatable denial of service on affected systems.
CVSS 3.1