The vulnerability in the Linux kernel's mlx5e driver (CVE-2026-64522) concerns improper handling of eswitch mode block counters during the processing of acquire-flow temporary Security Associations (SAs) for IPsec. Specifically, mlx5e_xfrm_add_state() would skip hardware offload setup for these temporary SAs but still unconditionally decrement the eswitch mode block counter, causing an underflow. The patch modifies the control flow to return immediately after installing the acquire SA offload handle, ensuring that mlx5_eswitch_unblock_mode() is only called when mlx5_eswitch_block_mode() was previously invoked, preventing counter underflow.

The vulnerability could cause inconsistent internal state in the eswitch offload mode counter due to underflow, potentially leading to undefined behavior in the mlx5e driver. No specific exploitation details or impacts such as privilege escalation or denial of service are provided in the available data.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the issue. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official kernel repositories for the relevant commit and update accordingly.