CVE-2026-98497

Received Received - Intake

Linux Kernel IPv6 IPsec Policy Mask Swap Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks independently, but setup_fte_addr6() installs each mask in the opposite address field. When the prefix lengths differ, this makes the source match use the destination prefix and the destination match use the source prefix. The resulting hardware rule can both miss traffic covered by the policy and match traffic outside it. Install each mask in its corresponding match field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98497

EUVD

EUVD-2026-103737

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	ca7992f52c2cb5ef61fbfa590a2d7c926f290237
Linux	Linux	ca7992f52c2cb5ef61fbfa590a2d7c926f290237
Linux	Linux	ca7992f52c2cb5ef61fbfa590a2d7c926f290237
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in the IPv6 IPsec policy mask handling. The function mlx5e_ipsec_policy_mask() incorrectly swaps source and destination prefix masks when setting up hardware rules. This causes the source match to use the destination prefix and vice versa, leading to incorrect traffic filtering.

Detection Guidance

This vulnerability affects the Linux kernel's mlx5e driver for Mellanox network cards. Detection requires checking kernel version and driver configuration. Inspect loaded kernel modules with lsmod | grep mlx5 and verify kernel version with uname -r. Check if IPv6 XFRM policies are configured with ip -6 xfrm policy.

Impact Analysis

This vulnerability can cause network traffic to be incorrectly filtered. It may result in legitimate traffic being blocked or unauthorized traffic being allowed, potentially disrupting network security and connectivity.

Compliance Impact

This vulnerability affects network traffic filtering in the Linux kernel, potentially leading to incorrect IPsec policy enforcement for IPv6 traffic. This could result in unauthorized data transmission or improper access controls, which may impact compliance with data protection standards like GDPR or HIPAA by compromising secure data handling and network segmentation requirements.

Mitigation Strategies

Apply the latest kernel update from your distribution to obtain the patched mlx5e driver. If immediate patching is not possible, disable IPv6 XFRM policies temporarily or restrict their use until the update is applied. Monitor network traffic for policy mismatches.

Hi! I’m here to help you understand CVE-2026-98497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70