The Linux kernel's pfkey_msg2xfrm_state() function mishandles IPComp (SADB_X_SATYPE_IPCOMP) states by allocating the compression algorithm structure (calg) without initializing the alg_key_len field. Since IPComp carries no key, the allocated memory is smaller and alg_key_len remains uninitialized, containing garbage data. Later, during XFRM_MSG_MIGRATE operations, xfrm_algo_clone() uses alg_key_len to determine the size of memory to duplicate. If alg_key_len is non-zero garbage, kmemdup() reads beyond the allocated memory, causing slab-out-of-bounds errors detected by KASAN. This can lead to kernel memory corruption or crashes. The vulnerability does not affect the XFRM netlink path due to input validation. The fix initializes calg->alg_key_len to zero, aligning with other algorithm branches and preventing out-of-bounds access.

The vulnerability can cause out-of-bounds memory reads in kernel space during migration of IPComp states, potentially leading to kernel crashes or memory corruption. This affects the stability and security of the kernel's networking subsystem handling IPComp. There is no indication of remote code execution or privilege escalation from the provided data. The issue is triggered by adding an IPComp Security Association via PF_KEY and migrating it.

A fix is available that initializes the alg_key_len field to zero in the IPComp compression algorithm structure, preventing uninitialized memory usage. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly stated in the input data; check the vendor advisory for the exact fixed kernel versions and apply updates accordingly.