CVE-2026-23440
net/mlx5e: Fix race condition during IPSec ESN update
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driver validates this event by querying the IPSec ASO and checking that the esn_event_arm field is 0x0, which indicates an event has occurred. After handling the event, the driver must re-arm the context by setting esn_event_arm back to 0x1. A race condition exists in this handling path. After validating the event, the driver calls mlx5_accel_esp_modify_xfrm() to update the kernel's xfrm state. This function temporarily releases and re-acquires the xfrm state lock. So, need to acknowledge the event first by setting esn_event_arm to 0x1. This prevents the driver from reprocessing the same ESN update if the hardware sends events for other reason. Since the next ESN update only occurs after nearly 2^31 packets are received, there's no risk of missing an update, as it will happen long after this handling has finished. Processing the event twice causes the ESN high-order bits (esn_msb) to be incremented incorrectly. The driver then programs the hardware with this invalid ESN state, which leads to anti-replay failures and a complete halt of IPSec traffic. Fix this by re-arming the ESN event immediately after it is validated, before calling mlx5_accel_esp_modify_xfrm(). This ensures that any spurious, duplicate events are correctly ignored, closing the race window.
INFO
Published Date :
April 3, 2026, 4:16 p.m.
Last Modified :
July 24, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Acknowledge the event by setting esn_event_arm to 0x1.
- Re-arm ESN event after validation.
- Call mlx5_accel_esp_modify_xfrm() after re-arming.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23440.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23440 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23440
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23440 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-23440 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net/mlx5e: Corrige condición de carrera durante la actualización de ESN de IPSec En modo de descarga completa de IPSec, el dispositivo informa un evento de envoltura de ESN (Número de Secuencia Extendido) al controlador. El controlador valida este evento consultando el ASO de IPSec y verificando que el campo esn_event_arm sea 0x0, lo que indica que ha ocurrido un evento. Después de manejar el evento, el controlador debe rearmar el contexto estableciendo esn_event_arm de nuevo a 0x1. Existe una condición de carrera en esta ruta de manejo. Después de validar el evento, el controlador llama a mlx5_accel_esp_modify_xfrm() para actualizar el estado xfrm del kernel. Esta función libera temporalmente y vuelve a adquirir el bloqueo de estado xfrm. Por lo tanto, es necesario reconocer el evento primero estableciendo esn_event_arm en 0x1. Esto evita que el controlador reprocese la misma actualización de ESN si el hardware envía eventos por otra razón. Dado que la próxima actualización de ESN solo ocurre después de que se reciben casi 2^31 paquetes, no hay riesgo de perder una actualización, ya que ocurrirá mucho después de que este manejo haya terminado. Procesar el evento dos veces hace que los bits de orden superior de ESN (esn_msb) se incrementen incorrectamente. El controlador luego programa el hardware con este estado ESN inválido, lo que lleva a fallos de anti-replay y una detención completa del tráfico IPSec. Solucione esto rearmando el evento ESN inmediatamente después de que sea validado, antes de llamar a mlx5_accel_esp_modify_xfrm(). Esto asegura que cualquier evento espurio o duplicado sea correctamente ignorado, cerrando la ventana de carrera. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fef06678931ff67b158d337b581e5cf5ca40a3a3', 'lessThan': '3dffc083292e6872787bd7e34b957627622f9af4', 'versionType': 'git'}, {'status': 'affected', 'version': 'fef06678931ff67b158d337b581e5cf5ca40a3a3', 'lessThan': '2051c709dce92da3550040aa7949cd5a9c89b14e', 'versionType': 'git'}, {'status': 'affected', 'version': 'fef06678931ff67b158d337b581e5cf5ca40a3a3', 'lessThan': '96c9c25b74686ac2de15921c9ad30c5ef13af8cd', 'versionType': 'git'}, {'status': 'affected', 'version': 'fef06678931ff67b158d337b581e5cf5ca40a3a3', 'lessThan': '8d625c15471fb8780125eaef682983a96af77bdc', 'versionType': 'git'}, {'status': 'affected', 'version': 'fef06678931ff67b158d337b581e5cf5ca40a3a3', 'lessThan': 'beb6e2e5976a128b0cccf10d158124422210c5ef', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.130', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.78', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
Initial Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.78 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.4.1 up to (excluding) 6.6.130 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 03, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driver validates this event by querying the IPSec ASO and checking that the esn_event_arm field is 0x0, which indicates an event has occurred. After handling the event, the driver must re-arm the context by setting esn_event_arm back to 0x1. A race condition exists in this handling path. After validating the event, the driver calls mlx5_accel_esp_modify_xfrm() to update the kernel's xfrm state. This function temporarily releases and re-acquires the xfrm state lock. So, need to acknowledge the event first by setting esn_event_arm to 0x1. This prevents the driver from reprocessing the same ESN update if the hardware sends events for other reason. Since the next ESN update only occurs after nearly 2^31 packets are received, there's no risk of missing an update, as it will happen long after this handling has finished. Processing the event twice causes the ESN high-order bits (esn_msb) to be incremented incorrectly. The driver then programs the hardware with this invalid ESN state, which leads to anti-replay failures and a complete halt of IPSec traffic. Fix this by re-arming the ESN event immediately after it is validated, before calling mlx5_accel_esp_modify_xfrm(). This ensures that any spurious, duplicate events are correctly ignored, closing the race window. Added Reference https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e Added Reference https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4 Added Reference https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc Added Reference https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd Added Reference https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef