CVE-2026-43199

net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

State: Published
Severity: 7.5 High
Published: May 6, 2026
Updated: Oct 21, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy() to get the local MAC address directly from netdev->dev_addr.

The issue occurs because mlx5_query_mac_address() queries the hardware which involves mlx5_cmd_exec() that can sleep, but it is called from the mlx5e_ipsec_handle_event workqueue which runs in atomic context.

The MAC address is already available in netdev->dev_addr, so no need to query hardware. This avoids the sleeping call and resolves the bug.

Call trace: BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200 __schedule+0x7ab/0xa20 schedule+0x1c/0xb0 schedule_timeout+0x6e/0xf0 __wait_for_common+0x91/0x1b0 cmd_exec+0xa85/0xff0 [mlx5_core] mlx5_cmd_exec+0x1f/0x50 [mlx5_core] mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core] mlx5_query_mac_address+0x19/0x30 [mlx5_core] mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core] mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core] mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core] process_one_work+0x178/0x2e0 worker_thread+0x2ea/0x430

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	cee137a634318bfbda18ee5af45d300153b57fa5 to before 5efde07521309274f26727860774614cbc187242Affected cee137a634318bfbda18ee5af45d300153b57fa5 to before e1407fb7c337373dfaaae2445d828b0b9ae26a29Affected cee137a634318bfbda18ee5af45d300153b57fa5 to before 57957bc7f1865778ec9b1618e15515feb6df7eb4Affected cee137a634318bfbda18ee5af45d300153b57fa5 to before 546de94e41e92e1f7dc6213615fb7c794d05db98Affected cee137a634318bfbda18ee5af45d300153b57fa5 to before 859380694f434597407632c29f30fdb5e763e6ccAffected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.160 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.16 through 6.18.Not affected 6.19.6 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

cee137a634318bfbda18ee5af45d300153b57fa5 to before 5efde07521309274f26727860774614cbc187242Affected
cee137a634318bfbda18ee5af45d300153b57fa5 to before e1407fb7c337373dfaaae2445d828b0b9ae26a29Affected
cee137a634318bfbda18ee5af45d300153b57fa5 to before 57957bc7f1865778ec9b1618e15515feb6df7eb4Affected
cee137a634318bfbda18ee5af45d300153b57fa5 to before 546de94e41e92e1f7dc6213615fb7c794d05db98Affected
cee137a634318bfbda18ee5af45d300153b57fa5 to before 859380694f434597407632c29f30fdb5e763e6ccAffected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.160 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.16 through 6.18.*Not affected
6.19.6 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.