Linux Kernel eswitch mode block underflow in mlx5e for IPsec SA
CVE-2026-64522 Published on July 25, 2026
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating
software state and skipping hardware offload setup.
That path jumps to the common success label before taking the eswitch mode
block. After tunnel-mode validation was moved earlier, the common success
label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,
this decrements esw->offloads.num_block_mode without a matching increment.
Return directly after installing the acquire SA offload handle, so only the
paths that successfully called mlx5_eswitch_block_mode() call the matching
unblock.
Products Associated with CVE-2026-64522
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 and below b5bd4249e430f5963d559708ee96a671716d2400 is affected.
- Version 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 and below ecafd8284e527666e83261e6e57a7c7341d591cb is affected.
- Version 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 and below abe003b33223ff33552f291644bf35d9c2f992fb is affected.
- Version 993c4ba71596c30418ba5a0ddcf4f9c2f431466a is affected.
- Version 6.17.4 and below 6.18 is affected.
- Version 6.18 is affected.
- Before 6.18 is unaffected.
- Version 6.18.34, <= 6.18.* is unaffected.
- Version 7.0.11, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.