Executive brief
A vulnerability in the Linux kernel's Mellanox network driver affects systems using IPSec hardware acceleration. A race condition in how the driver handles security sequence numbers can cause the system to incorrectly process encrypted traffic. This results in a complete failure of IPSec communications, potentially leading to a denial of service for secure network connections.
Technical details
A race condition exists in the mlx5e driver's IPSec full offload mode during Extended Sequence Number (ESN) wrap events. When the driver handles an ESN wrap, it validates the event but temporarily releases the xfrm state lock to call mlx5_accel_esp_modify_xfrm(). During this window, duplicate or spurious hardware events can cause the driver to increment the ESN high-order bits (esn_msb) multiple times incorrectly. This results in invalid ESN state being programmed into the hardware, causing anti-replay failures and a complete halt of IPSec traffic. The fix involves re-arming the ESN event immediately after validation to ensure subsequent events are ignored until the current update completes.
Affected products
- Linux Linux Kernel fef06678931f to 3dffc083292e (6.1.y), 2051c709dce9 (6.6.y), 96c9c25b7468 (6.7.y), 8d625c15471f (6.8.y), beb6e2e5976a (mainline)
Timeline
- 2026-03-16: other: Patch authored
- 2026-03-25: patched: Commits merged into stable branches
- 2026-04-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e
- https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4
- https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc
- https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd
- https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef