[PATCH 0/8] pull request (net): ipsec 2026-07-29

[Steffen Klassert <steffen.klassert@secunet.com>]

1) xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
   Fix an off-by-one in xfrm6_input_addr() secpath depth check
   that could write one slot past xvec[].

2) esp: do not unref managed frag pages in esp_ssg_unref()
   Skip unref in esp_ssg_unref() for managed frag pages, avoiding
   a page-ref underflow when frags are owned by a zerocopy ubuf.

3) xfrm: espintcp: fix UAF during close
   Serialize espintcp_close() with xfrm_trans_reinject so the
   saved skb isn't freed while still in use.

4) xfrm: drop ESP-in-TCP packets with no ingress device
   Drop ESP-in-TCP records whose saved ingress device can no
   longer be resolved, avoiding a NULL deref in the XFRM input path.

5) xfrm: avoid lock inversion in nat keepalive work
   Walk the state table under xfrm_state_lock but defer per-state
   x->lock acquisition until after, avoiding an AB-BA inversion
   with SA deletion.

6) xfrm: Fix skb double-free in xfrm_dev_direct_output()
   Return local_out()'s result from xfrm_dev_direct_output()
   instead of freeing the skb unconditionally, avoiding a
   double-free when netfilter or another consumer takes ownership.

7) xfrm: ah6: validate routing header segments_left
   Validate routing-header segments_left before rearranging it
   in AH6, avoiding an OOB read on malformed packets.

8) xfrm: fix xfrm_state_construct() auth-trunc leak
   Track the allocated x->aalg directly in xfrm_state_construct()
   so attach_auth() doesn't overwrite and leak it.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 3f1f755366687d051174739fb99f7d560202f60b:

  net: openvswitch: reject oversized nested action attrs (2026-07-11 13:09:11 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git tags/ipsec-2026-07-29

for you to fetch changes up to c12cbf56320fb633484ee0ca1fb7d68d6b64b213:

  xfrm: fix xfrm_state_construct() auth-trunc leak (2026-07-28 10:48:18 +0200)

----------------------------------------------------------------
ipsec-2026-07-29

----------------------------------------------------------------
Asim Viladi Oglu Manizada (1):
      xfrm: ah6: validate routing header segments_left

Maher Azzouzi (1):
      esp: do not unref managed frag pages in esp_ssg_unref()

Sabrina Dubroca (1):
      xfrm: espintcp: fix UAF during close

Sanghyun Park (1):
      xfrm: Fix skb double-free in xfrm_dev_direct_output()

Xiang Mei (1):
      xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Zhiling Zou (1):
      xfrm: drop ESP-in-TCP packets with no ingress device

Zihan Xi (2):
      xfrm: avoid lock inversion in nat keepalive work
      xfrm: fix xfrm_state_construct() auth-trunc leak

 net/ipv4/esp4.c               |  7 ++++++
 net/ipv6/ah6.c                | 29 +++++++++++++---------
 net/ipv6/esp6.c               |  7 ++++++
 net/ipv6/xfrm6_input.c        |  2 +-
 net/xfrm/espintcp.c           |  9 ++++++-
 net/xfrm/xfrm_nat_keepalive.c | 57 ++++++++++++++++++++++++++++++++++++-------
 net/xfrm/xfrm_output.c        |  4 +--
 net/xfrm/xfrm_user.c          |  2 +-
 8 files changed, 91 insertions(+), 26 deletions(-)