Thank you @zsdc for your fast response!

I observed some issues with rekey related to this ticket. With this patch enabled in vpp rekeying the child_sa is not working properly. It seems like the kernel sometimes will send a expired message for the newly established child SA.
In the strongswan logs you will see received a XFRM_MSG_EXPIRE and subsequent deletion of the new child sa. Sometimes rekeying will succeed, sometimes there will be 30 or more keyexchanges in a row.