Look up another CVE · open CVE-2026-64522 in the interactive tracker
CVE-2026-64522
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64522 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
- What this is
- MELLANOX ETHERNET INNOVA DRIVERSMAINTAINERS section matched on drivers/net/ethernet/mellanox/mlx5/core/en_accel/* · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.18 | 6.18.34 | b5bd4249e430 |
| 6.18 | 7.0.11 | ecafd8284e52 |
| 6.18 | 7.1 | abe003b33223 |
| 6.17.4 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- A remote TCP SYN can cause the kernel to route a SYN-ACK through an administrator-configured outbound mlx5 IPsec policy, reaching xfrm_state_find() and the vulnerable acquire-SA callback.
- AC:LAttack complexity, low
- Once the affected packet-offload policy is deployed without a matching SA, the first matching flow deterministically performs the unmatched decrement; no race must be won.
- PR:NPrivileges required, none
- The remote peer needs no credentials or capabilities; configuring the mlx5 IPsec policy is a deployment prerequisite, not an attacker privilege.
- UI:RUser interaction, required
- The highest-impact stale-object path requires an administrator to request an eswitch mode transition after the attacker has cancelled the live mode-block reference.
- S:UScope, unchanged
- The resulting corruption affects the same host kernel and mlx5 device security authority, without crossing a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- The incorrectly permitted mode transition frees mlx5 IPsec structures while XFRM policies retain references to them, creating subsequent use-after-free callbacks capable of exposing kernel memory.
- I:HIntegrity impact, high
- The stale policy and flow-table references can be reclaimed and attacker-influenced, making the resulting kernel use-after-free potentially exploitable for arbitrary writes or control-flow hijacking.
- A:HAvailability impact, high
- Mode-transition teardown or later automatic policy expiration can dereference freed IPsec and flow-rule objects, causing a kernel warning, oops, or panic.