Steffen Klassert

The issue is related to a potential Spectre v1 gadget in the `xfrm xlate32 attr()` function. This could allow an attacker to leak kernel memory content to malicious users. The vulnerability is caused by the use of the `type` variable as an array index, which can be exploited to bypass security measures. The `array index nospec()` function can be used to prevent this type of attack.

An issue was discovered in the Linux kernel where the `xfrm expand policies` function in `net/xfrm/xfrm policy.c` can cause a refcount to be dropped twice, potentially leading to a denial of service. This issue can be exploited by a remote attacker.

The issue is related to the `xfrm state netlink` function in the Linux kernel, which does not properly handle error conditions in `dump one state` function calls. This can be exploited by local users with the `CAP NET ADMIN` capability to gain privileges or cause a denial of service, resulting in a NULL pointer dereference and system crash.