CVE-2026-64522

Awaiting Analysis Awaiting Analysis - Queue

Linux Kernel Eswitch Mode Block Underflow in mlx5e

Publication date: 2026-07-25

Last updated on: 2026-11-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-11-03

Generated

2026-11-09

AI Q&A

2026-07-25

EPSS Evaluated

2026-11-08

NVD

CVE-2026-64522

EUVD

EUVD-2026-48866

Affected Vendors & Products

Vendor	Product	Version / Range
mlx5	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a block underflow issue in the mlx5e driver related to IPsec acquire SA handling. The problem occurs when temporary security associations (SAs) are allocated for acquire-flow without proper hardware offload setup. The code incorrectly decrements a counter without a matching increment, leading to an imbalance in the eswitch mode block tracking.

Detection Guidance

Detection requires checking for kernel logs or errors related to mlx5e eswitch mode block underflow. Monitor for messages indicating SA offload failures or mode block mismatches in kernel logs using commands like dmesg | grep mlx5e or journalctl -k | grep mlx5e.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using the Linux kernel with Mellanox mlx5e network drivers. It may disrupt network functionality, particularly in environments relying on IPsec for secure communications, leading to potential service disruptions or security gaps.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network driver functionality and does not involve data handling, privacy, or security controls that would impact regulatory compliance.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. If immediate patching is not possible, disable IPsec offload for mlx5e interfaces or restrict SA acquire flows until patched.

Hi! I’m here to help you understand CVE-2026-64522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...