In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert
loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or
fail. But its guard is inverted: it skips policies with prefixlen <
threshold and preallocates for the rest.

prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and
the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the
loop preallocates for the exact policies (which never allocate) and skips
the inexact ones, whose bin/node is then allocated GFP_ATOMIC during
reinsert. On failure the error path only WARN_ONCE()s and continues,
leaving a poisoned bydst node; the next rebuild's hlist_del_rcu()
dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure,
deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted policies;
the reinsert then allocates nothing and cannot fail.

Crash:
  Oops: general protection fault, probably for non-canonical address
  0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
  KASAN: maybe wild-memory-access in range [0xdead...]
  ...
  Workqueue: events xfrm_hash_rebuild
  RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190
  RAX: dead000000000122   (LIST_POISON2 + offset)
  ...
  Call Trace:
   hlist_del_rcu (include/linux/rculist.h:599)
   xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   ...
  Kernel panic - not syncing: Fatal exception in interrupt

https://git.kernel.org/stable/c/6aa3796d18a9fda953ad76a62b57bf6c145cb9ef

https://git.kernel.org/stable/c/7acc5ed2f33608a3d83b64f50a5766843b6e2485

https://git.kernel.org/stable/c/94c00391a5117530188334f740ce26d3f1256190

https://git.kernel.org/stable/c/d9d9cc21cc90014724a14c447e3d587be9447107

https://git.kernel.org/stable/c/f38f8cce2f7e79775b3db7e8a5eacda04ac908e4

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"24969facd704a5f0dd8e08da86bf32a9ce972bee","lessThan":"d9d9cc21cc90014724a14c447e3d587be9447107","versionType":"git","status":"affected"},{"version":"24969facd704a5f0dd8e08da86bf32a9ce972bee","lessThan":"94c00391a5117530188334f740ce26d3f1256190","versionType":"git","status":"affected"},{"version":"24969facd704a5f0dd8e08da86bf32a9ce972bee","lessThan":"7acc5ed2f33608a3d83b64f50a5766843b6e2485","versionType":"git","status":"affected"},{"version":"24969facd704a5f0dd8e08da86bf32a9ce972bee","lessThan":"6aa3796d18a9fda953ad76a62b57bf6c145cb9ef","versionType":"git","status":"affected"},{"version":"24969facd704a5f0dd8e08da86bf32a9ce972bee","lessThan":"f38f8cce2f7e79775b3db7e8a5eacda04ac908e4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]