[PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in msgsize helpers

[Adrian Martinez Garcia]

Hi,

The xfrm_acquire_msgsize(), xfrm_polexpire_msgsize() and xfrm_expire_msgsize()
helpers do not account for the XFRMA_IF_ID (8 B) and XFRMA_OFFLOAD_DEV
(12 B) attributes that their sibling builders emit. The deficit of up to
20 B can trigger BUG_ON(err < 0) in the callers -> latent kernel panic.

This is a sibling of CVE-2026-43107 (fix 7081d46d32 only corrected the
aevent pair; these three pairs were left unfixed).

Fixes: 7e6526404ade
Signed-off-by: Adrian Martinez <adrimg3196@xxxxxxxxx>

I used Claude Code to help with the audit.

Attachment: 0001-xfrm-account-XFRMA_IF_ID-and-XFRMA_OFFLOAD_DEV.patch
Description: Binary data