Executive brief
A vulnerability was identified in the Linux kernel's Mellanox (mlx5) network driver related to how it handles secure IPsec connections. Under specific conditions when setting up temporary security associations, the system could incorrectly track internal state, potentially leading to system instability or unexpected behavior in network offloading. This issue primarily affects systems using Mellanox network hardware for high-performance encrypted networking.
Technical details
A logic error in the mlx5e_xfrm_add_state() function in the Linux kernel's mlx5 driver causes an E-Switch mode block underflow. When handling 'acquire-flow' temporary Security Associations (SAs), the code jumps to a success label that unconditionally calls mlx5_eswitch_unblock_mode(). Because the corresponding block increment was skipped for these specific SAs, the internal counter (esw->offloads.num_block_mode) is decremented without a matching increment. This results in an underflow of the reference counter used to manage hardware offload states. The fix involves returning early for acquire SAs to ensure the unblock function is only called by paths that previously performed a block.
Affected products
- Linux Linux Kernel 6.17.4 to 6.18, 6.18.34, 7.0.11
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory