CVE-2026-64522net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 before b5bd4249e430f5963d559708ee96a671716d2400; from 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 before ecafd8284e527666e83261e6e57a7c7341d591cb; from 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 before abe003b33223ff33552f291644bf35d9c2f992fb; 993c4ba71596c30418ba5a0ddcf4f9c2f431466a; from 6.17.4 before 6.18 | CNA record |
References
- https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400
- https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb
- https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.