CVE-2025-38097

In the Linux kernel, the following vulnerability has been resolved:

espintcp: remove encap socket caching to avoid reference leak

The current scheme for caching the encap socket can lead to reference

leaks when we try to delete the netns.

The reference chain is: xfrm_state -> enacp_sk -> netns

Since the encap socket is a userspace socket, it holds a reference on

the netns. If we delete the espintcp state (through flush or

individual delete) before removing the netns, the reference on the

socket is dropped and the netns is correctly deleted. Otherwise, the

netns may not be reachable anymore (if all processes within the ns

have terminated), so we cannot delete the xfrm state to drop its

reference on the socket.

This patch results in a small (~2% in my tests) performance

regression.

A GC-type mechanism could be added for the socket cache, to clear

references if the state hasn't been used "recently", but it's a lot

more complex than just not caching the socket.