Riskcovery

CVE-2026-64522

net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

State
Published
Severity
8.8 High
Published
Jul 25, 2026
Updated
Oct 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup.

That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment.

Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HLinux

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
LinuxLinux
  • 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 to before b5bd4249e430f5963d559708ee96a671716d2400Affected
  • 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 to before ecafd8284e527666e83261e6e57a7c7341d591cbAffected
  • 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 to before abe003b33223ff33552f291644bf35d9c2f992fbAffected
  • 993c4ba71596c30418ba5a0ddcf4f9c2f431466aAffected
  • 6.17.4 to before 6.18Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.