Executive brief
A vulnerability in the Linux kernel's Mellanox network driver can cause a system crash when changing network configuration modes. Specifically, when a user attempts to switch a network device to 'switchdev' mode on hardware that does not support IPsec, the system incorrectly attempts to clean up non-existent security resources. This results in a kernel crash (NULL pointer dereference), leading to a complete denial of service for the affected host.
Technical details
The vulnerability is a NULL pointer dereference within the net/mlx5 driver of the Linux kernel. When transitioning a device to switchdev mode, the driver's cleanup routine (specifically within mlx5e_ipsec_disable_events) attempts to release IPsec-related resources even if the underlying hardware does not support IPsec. This occurs because the code fails to verify IPsec capability before proceeding with the cleanup, leading to a crash when it attempts to access uninitialized or NULL pointers. An attacker with local privileges sufficient to trigger network configuration changes (e.g., via devlink) can cause a kernel panic and denial of service. Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux kernel 6.12.56 to 6.12.78, 6.17.6 to 6.18, 6.18.1 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-03-05: patched: Initial patch authored by Patrisious Haddad
- 2026-05-08: disclosed: CVE published