The Linux kernel net/mlx5e subsystem contained a vulnerability where the function mlx5e_xfrm_add_state() mishandled acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. The code path jumped to a common success label that unconditionally called mlx5_eswitch_unblock_mode(), decrementing esw->offloads.num_block_mode without a corresponding increment, leading to an eswitch mode block underflow. The fix involves returning directly after installing the acquire SA offload handle to ensure only paths that called mlx5_eswitch_block_mode() call the matching unblock. This vulnerability is tracked as CVE-2026-64522 and affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds.

The vulnerability could lead to incorrect handling of eswitch mode blocks in the IPsec subsystem, potentially causing system instability or security issues related to IPsec state management. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability, though no known exploits in the wild have been reported. Successful exploitation could allow an attacker to disrupt or compromise IPsec operations on affected Linux kernel versions.

A patch is available and should be applied promptly. The issue is fixed in Linux kernel versions 7.0.0-28.28 and later, including various specific builds listed in the advisory. Users should update their systems to these fixed versions and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating kernel packages to ensure complete remediation.