CVE-2026-23441
net/mlx5e: Prevent concurrent access to IPSec ASO context
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context is now copied to this private context while the ASO spinlock is held. Subsequent processing uses this saved, per-object context, ensuring its integrity is maintained.
INFO
Published Date :
April 3, 2026, 4:16 p.m.
Last Modified :
July 24, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the kernel commit that introduces private contexts.
- Ensure ASO spinlock protects context copying.
- Verify hardware processing completes before spinlock release.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23441.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23441 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23441
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23441 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-23441 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net/mlx5e: Evitar el acceso concurrente al contexto ASO de IPSec La consulta o actualización del objeto de descarga de IPSec se realiza a través de Access ASO WQE. El controlador utiliza una única estructura mlx5e_ipsec_aso para cada PF, que contiene un contexto compartido mapeado por DMA para todas las operaciones ASO. Existe una condición de carrera porque el spinlock ASO se libera antes de que el hardware haya terminado de procesar el WQE. Si una segunda operación se inicia inmediatamente después, sobrescribe el contexto compartido en el área DMA. Cuando la finalización de la primera operación se procesa más tarde, lee este contexto corrupto, lo que lleva a un comportamiento inesperado y resultados incorrectos. Este commit corrige la condición de carrera introduciendo un contexto privado dentro de cada objeto de descarga de IPSec. El contexto ASO compartido ahora se copia a este contexto privado mientras el spinlock ASO está retenido. El procesamiento posterior utiliza este contexto guardado por objeto, asegurando que su integridad se mantenga. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1ed78fc033074c55221a80498204c539a3696877', 'lessThan': '99aaee927800ea00b441b607737f9f67b1899755', 'versionType': 'git'}, {'status': 'affected', 'version': '1ed78fc033074c55221a80498204c539a3696877', 'lessThan': 'c3db55dc0f3344b62da25b025a8396d78763b5fa', 'versionType': 'git'}, {'status': 'affected', 'version': '1ed78fc033074c55221a80498204c539a3696877', 'lessThan': '2c6a5be0aee5a44066f68a332c30650900e32ad4', 'versionType': 'git'}, {'status': 'affected', 'version': '1ed78fc033074c55221a80498204c539a3696877', 'lessThan': '6834d196107d5267dcad31b44211da7698e8f618', 'versionType': 'git'}, {'status': 'affected', 'version': '1ed78fc033074c55221a80498204c539a3696877', 'lessThan': '99b36850d881e2d65912b2520a1c80d0fcc9429a', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h', 'drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.130', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.78', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h', 'drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2.1 up to (excluding) 6.6.130 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.78 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2c6a5be0aee5a44066f68a332c30650900e32ad4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6834d196107d5267dcad31b44211da7698e8f618 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/99aaee927800ea00b441b607737f9f67b1899755 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/99b36850d881e2d65912b2520a1c80d0fcc9429a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c3db55dc0f3344b62da25b025a8396d78763b5fa Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 03, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context is now copied to this private context while the ASO spinlock is held. Subsequent processing uses this saved, per-object context, ensuring its integrity is maintained. Added Reference https://git.kernel.org/stable/c/2c6a5be0aee5a44066f68a332c30650900e32ad4 Added Reference https://git.kernel.org/stable/c/6834d196107d5267dcad31b44211da7698e8f618 Added Reference https://git.kernel.org/stable/c/99aaee927800ea00b441b607737f9f67b1899755 Added Reference https://git.kernel.org/stable/c/99b36850d881e2d65912b2520a1c80d0fcc9429a Added Reference https://git.kernel.org/stable/c/c3db55dc0f3344b62da25b025a8396d78763b5fa