Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA… (CVE-2026-64522)
Affects linux-hwe-edgeSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| linux-hwe-edge | Affected
| Fixed in– |
AI-suggested
A patch is available and should be applied promptly. The issue is fixed in Linux kernel versions 7.0.0-28.28 and later, including various specific builds listed in the advisory. Users should update their systems to these fixed versions and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating kernel packages to ensure complete remediation.
Description
A vulnerability in the Linux kernel's net/mlx5e subsystem related to eswitch mode block underflow during IPsec acquire SA handling has been resolved. The flaw involved a decrement of a counter without a matching increment, potentially causing incorrect state handling. This issue is addressed in Linux kernel versions 7.0.0 and later. The vulnerability has a CVSS score of 8.8, indicating high severity with potential impacts on confidentiality, integrity, and availability. A patch is available and should be applied to affected systems.
Impact
The vulnerability could lead to incorrect handling of eswitch mode blocks in the IPsec subsystem, potentially causing system instability or security issues related to IPsec state management. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability, though no known exploits in the wild have been reported. Successful exploitation could allow an attacker to disrupt or compromise IPsec operations on affected Linux kernel versions.
Summary
The Linux kernel net/mlx5e subsystem contained a vulnerability where the function mlx5e_xfrm_add_state() mishandled acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. The code path jumped to a common success label that unconditionally called mlx5_eswitch_unblock_mode(), decrementing esw->offloads.num_block_mode without a corresponding increment, leading to an eswitch mode block underflow. The fix involves returning directly after installing the acquire SA offload handle to ensure only paths that called mlx5_eswitch_block_mode() call the matching unblock. This vulnerability is tracked as CVE-2026-64522 and affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64522 (opens in a new tab)
- git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb (opens in a new tab)
- git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400 (opens in a new tab)
- git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb (opens in a new tab)
- ubuntu.com/security/CVE-2026-64522 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-64522 (opens in a new tab)
- git.kernel.org/linus/abe003b33223ff33552f291644bf35d9c2f992fb (opens in a new tab)
- ubuntu.com/security/notices/USN-8618-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8663-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8664-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8728-1 (opens in a new tab)