CVE-2026-23440
Race Condition in Linux mlx5e Driver Causes IPSec Traffic Halt
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.4 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 6.4.1 (inc) to 6.6.130 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mlx5e network driver related to IPSec Extended Sequence Number (ESN) handling in full offload mode.
When the device reports an ESN wrap event, the driver validates it and must re-arm the event context by setting a specific field (esn_event_arm) back to 0x1 to prevent reprocessing the same event.
A race condition occurs because the driver updates the kernel's xfrm state while temporarily releasing and re-acquiring a lock, allowing the event to be processed twice.
Processing the event twice causes incorrect incrementing of the ESN high-order bits, leading to the hardware being programmed with an invalid ESN state.
This results in anti-replay failures and a complete halt of IPSec traffic.
The fix involves re-arming the ESN event immediately after validation and before updating the xfrm state, closing the race window and preventing duplicate event processing.
How can this vulnerability impact me? :
This vulnerability can cause a complete halt of IPSec traffic on affected systems.
Because the ESN state is incorrectly updated due to the race condition, anti-replay protections fail, which can disrupt secure communications relying on IPSec.
This disruption can lead to network outages or degraded security for systems using IPSec full offload mode with the affected driver.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by re-arming the ESN event immediately after it is validated, before calling mlx5_accel_esp_modify_xfrm(). This prevents the driver from reprocessing the same ESN update and closes the race condition.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix for the net/mlx5e driver handling IPSec ESN updates.