CVE-2026-64522
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.
How to fix
- Linux Linuxb5bd4249e430f5963d559708ee96a671716d2400, ecafd8284e527666e83261e6e57a7c7341d591cb, abe003b33223ff33552f291644bf35d9c2f992fb, 6.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ≤ v < b5bd4249e430f5963d559708ee96a671716d2400, 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ≤ v < ecafd8284e527666e83261e6e57a7c7341d591cb, 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ≤ v < abe003b33223ff33552f291644bf35d9c2f992fb, 993c4ba71596c30418ba5a0ddcf4f9c2f431466a, 6.17.4 ≤ v < 6.18, 6.18 | b5bd4249e430f5963d559708ee96a671716d2400, ecafd8284e527666e83261e6e57a7c7341d591cb, abe003b33223ff33552f291644bf35d9c2f992fb, 6.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.