Executive brief
A vulnerability in the Linux kernel's Mellanox network driver could allow a local user to cause system instability or incorrect network behavior. The issue occurs when the system handles multiple secure network (IPSec) requests simultaneously, leading to internal data corruption. This could result in a service outage or failure of security offloading features on affected hardware.
Technical details
A race condition exists in the net/mlx5e driver's IPSec offload implementation. The driver uses a single shared DMA-mapped context (mlx5e_ipsec_aso) for all Advanced Steering Operations (ASO) per Physical Function (PF). The ASO spinlock is released before the hardware finishes processing the Work Queue Element (WQE), allowing a subsequent operation to overwrite the shared DMA area. When the first operation completes, it reads the corrupted context, leading to incorrect results or kernel instability. The fix introduces a private context within each IPSec offload object to ensure data integrity during concurrent operations. Patch availability is confirmed across multiple stable kernel branches (6.6.y, 6.12.y, 6.18.y).
Affected products
- Linux Linux Kernel 6.2 to 6.18.20
Timeline
- 2026-04-03: advisory: Initial publication of CVE-2026-23441
- 2026-03-25: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/2c6a5be0aee5a44066f68a332c30650900e32ad4
- https://git.kernel.org/stable/c/6834d196107d5267dcad31b44211da7698e8f618
- https://git.kernel.org/stable/c/99aaee927800ea00b441b607737f9f67b1899755
- https://git.kernel.org/stable/c/99b36850d881e2d65912b2520a1c80d0fcc9429a
- https://git.kernel.org/stable/c/c3db55dc0f3344b62da25b025a8396d78763b5fa