In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use… (CVE-2026-98497)

The Linux kernel vulnerability CVE-2026-98497 involves the mlx5e driver handling of IPv6 IPsec policy masks. IPv6 XFRM policies can have different source and destination prefix lengths. The function mlx5e_ipsec_policy_mask() builds masks independently, but setup_fte_addr6() incorrectly installs each mask in the opposite address field. This causes the source match to use the destination prefix and vice versa, resulting in hardware rules that may miss traffic covered by the policy or match traffic outside the intended policy. The fix ensures each mask is installed in its corresponding match field.

The vulnerability can cause IPsec policies for IPv6 traffic to be improperly enforced by the hardware, potentially allowing some traffic that should be protected to bypass the policy or causing legitimate traffic to be incorrectly matched. This undermines the effectiveness of IPsec protections on affected systems.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the mask installation logic in the mlx5e driver. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation.