CVE-2026-23440

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23440", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.017Z", "datePublished": "2026-04-03T15:15:24.596Z", "dateUpdated": "2026-10-19T18:35:43.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:46.631Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel's xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there's no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable ESN update path is driven by mlx5 IPsec full-offload hardware events caused by ESP traffic on an offloaded SA, so a remote IPsec peer can reach it over the network in a reasonable VPN/gateway deployment.\nAC:L - The triggering conditions are traffic volume and event timing on an active ESN SA; the attacker can drive repeated packet processing and, under the required overestimate rule, the race is treated as practically triggerable.\nPR:N - No local kernel privilege is needed to send traffic to an already configured IPsec endpoint; although valid SA traffic may be required, the runtime trigger is network packet processing rather than a privileged local ioctl/netlink operation.\nUI:N - Once the affected mlx5 IPsec offload SA exists, exploitation does not require a victim user to perform any action.\nS:U - The impact remains within the same kernel/networking security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug corrupts ESN accounting/state and causes packet rejection, but there is no evidence of information disclosure or arbitrary memory read.\nI:N - The invalid esn_msb state does not give an attacker data modification, arbitrary write, or code execution; it results in anti-replay failures.\nA:H - Processing the ESN event twice programs invalid hardware ESN state, leading to anti-replay failures and a complete halt of affected IPsec traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "versions": [{"version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "3dffc083292e6872787bd7e34b957627622f9af4", "status": "affected", "versionType": "git"}, {"version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "2051c709dce92da3550040aa7949cd5a9c89b14e", "status": "affected", "versionType": "git"}, {"version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "96c9c25b74686ac2de15921c9ad30c5ef13af8cd", "status": "affected", "versionType": "git"}, {"version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "8d625c15471fb8780125eaef682983a96af77bdc", "status": "affected", "versionType": "git"}, {"version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "beb6e2e5976a128b0cccf10d158124422210c5ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4"}, {"url": "https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e"}, {"url": "https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd"}, {"url": "https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc"}, {"url": "https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef"}], "title": "net/mlx5e: Fix race condition during IPSec ESN update", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23440", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:08:06.738752Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:43.781Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23440", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:08:06.738752Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:08:07.389Z"}}], "cna": {"title": "net/mlx5e: Fix race condition during IPSec ESN update", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable ESN update path is driven by mlx5 IPsec full-offload hardware events caused by ESP traffic on an offloaded SA, so a remote IPsec peer can reach it over the network in a reasonable VPN/gateway deployment.\nAC:L - The triggering conditions are traffic volume and event timing on an active ESN SA; the attacker can drive repeated packet processing and, under the required overestimate rule, the race is treated as practically triggerable.\nPR:N - No local kernel privilege is needed to send traffic to an already configured IPsec endpoint; although valid SA traffic may be required, the runtime trigger is network packet processing rather than a privileged local ioctl/netlink operation.\nUI:N - Once the affected mlx5 IPsec offload SA exists, exploitation does not require a victim user to perform any action.\nS:U - The impact remains within the same kernel/networking security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug corrupts ESN accounting/state and causes packet rejection, but there is no evidence of information disclosure or arbitrary memory read.\nI:N - The invalid esn_msb state does not give an attacker data modification, arbitrary write, or code execution; it results in anti-replay failures.\nA:H - Processing the ESN event twice programs invalid hardware ESN state, leading to anti-replay failures and a complete halt of affected IPsec traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "3dffc083292e6872787bd7e34b957627622f9af4", "versionType": "git"}, {"status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "2051c709dce92da3550040aa7949cd5a9c89b14e", "versionType": "git"}, {"status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "96c9c25b74686ac2de15921c9ad30c5ef13af8cd", "versionType": "git"}, {"status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "8d625c15471fb8780125eaef682983a96af77bdc", "versionType": "git"}, {"status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "lessThan": "beb6e2e5976a128b0cccf10d158124422210c5ef", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4"}, {"url": "https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e"}, {"url": "https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd"}, {"url": "https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc"}, {"url": "https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel's xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there's no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:46.631Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23440", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:35:43.781Z", "dateReserved": "2026-01-13T15:37:46.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-03T15:15:24.596Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3dffc083292e6872787bd7e34b957627622f9af4", "status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "versionType": "git"}, {"lessThan": "2051c709dce92da3550040aa7949cd5a9c89b14e", "status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "versionType": "git"}, {"lessThan": "96c9c25b74686ac2de15921c9ad30c5ef13af8cd", "status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "versionType": "git"}, {"lessThan": "8d625c15471fb8780125eaef682983a96af77bdc", "status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "versionType": "git"}, {"lessThan": "beb6e2e5976a128b0cccf10d158124422210c5ef", "status": "affected", "version": "fef06678931ff67b158d337b581e5cf5ca40a3a3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5ED2C179-5F1F-4BB1-9DEA-A21F23BC569B", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*", "matchCriteriaId": "DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel's xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there's no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5e: Corrige condici\u00f3n de carrera durante la actualizaci\u00f3n de ESN de IPSec\n\nEn modo de descarga completa de IPSec, el dispositivo informa un evento de envoltura de ESN (N\u00famero de Secuencia Extendido) al controlador. El controlador valida este evento consultando el ASO de IPSec y verificando que el campo esn_event_arm sea 0x0, lo que indica que ha ocurrido un evento. Despu\u00e9s de manejar el evento, el controlador debe rearmar el contexto estableciendo esn_event_arm de nuevo a 0x1.\n\nExiste una condici\u00f3n de carrera en esta ruta de manejo. Despu\u00e9s de validar el evento, el controlador llama a mlx5_accel_esp_modify_xfrm() para actualizar el estado xfrm del kernel. Esta funci\u00f3n libera temporalmente y vuelve a adquirir el bloqueo de estado xfrm.\n\nPor lo tanto, es necesario reconocer el evento primero estableciendo esn_event_arm en 0x1. Esto evita que el controlador reprocese la misma actualizaci\u00f3n de ESN si el hardware env\u00eda eventos por otra raz\u00f3n. Dado que la pr\u00f3xima actualizaci\u00f3n de ESN solo ocurre despu\u00e9s de que se reciben casi 2^31 paquetes, no hay riesgo de perder una actualizaci\u00f3n, ya que ocurrir\u00e1 mucho despu\u00e9s de que este manejo haya terminado.\n\nProcesar el evento dos veces hace que los bits de orden superior de ESN (esn_msb) se incrementen incorrectamente. El controlador luego programa el hardware con este estado ESN inv\u00e1lido, lo que lleva a fallos de anti-replay y una detenci\u00f3n completa del tr\u00e1fico IPSec.\n\nSolucione esto rearmando el evento ESN inmediatamente despu\u00e9s de que sea validado, antes de llamar a mlx5_accel_esp_modify_xfrm(). Esto asegura que cualquier evento espurio o duplicado sea correctamente ignorado, cerrando la ventana de carrera."}], "id": "CVE-2026-23440", "lastModified": "2026-10-19T19:17:48.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23440", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:08:06.738752Z", "version": "2.0.3"}}]}, "published": "2026-04-03T16:16:26.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2051c709dce92da3550040aa7949cd5a9c89b14e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3dffc083292e6872787bd7e34b957627622f9af4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/mlx5e: Fix race condition during IPSec ESN update", "id": "2454857", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454857"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's net/mlx5e component. A race condition occurs during the handling of IPSec (Internet Protocol Security) Extended Sequence Number (ESN) updates. This can cause the system to process the same update event multiple times, leading to an incorrect ESN state. The consequence is anti-replay failures and a complete halt of IPSec traffic, resulting in a Denial of Service."], "name": "CVE-2026-23440", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23440\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23440\nhttps://lore.kernel.org/linux-cve-announce/2026040313-CVE-2026-23440-9b9f@gregkh/T"], "statement": "This vulnerability specifically affects systems using Mellanox ConnectX network adapters with IPSec full offload mode enabled. The race condition causes IPSec traffic to halt but does not allow code execution or data disclosure. Systems not using mlx5 hardware or not using IPSec offload are unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef06678931ff67b158d337b581e5cf5ca40a3a3,3dffc083292e6872787bd7e34b957627622f9af4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef06678931ff67b158d337b581e5cf5ca40a3a3,2051c709dce92da3550040aa7949cd5a9c89b14e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef06678931ff67b158d337b581e5cf5ca40a3a3,96c9c25b74686ac2de15921c9ad30c5ef13af8cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef06678931ff67b158d337b581e5cf5ca40a3a3,8d625c15471fb8780125eaef682983a96af77bdc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef06678931ff67b158d337b581e5cf5ca40a3a3,beb6e2e5976a128b0cccf10d158124422210c5ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T08:54:56.129817+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes commit 2051c709dce92da3550040aa7949cd5a9c89b14e, which fixes the race condition.", "If an immediate kernel update is not feasible, restrict the use of IPsec full offload or disable the mlx5e driver until the patch is applied.", "Monitor kernel changelogs and vendor security advisories for future updates."], "summary": {"action": "Apply patch", "impact": "ESN race condition causing anti\u2011replay failures and a halt of IPsec traffic"}, "threat_synthesis": {"affected_systems": "This flaw affects the Linux kernel driver for Mellanox/ConnectX devices (mlx5e) when IPsec full offload is enabled. No specific kernel release dates are supplied in the description, so the vulnerability may be present in any kernel version that includes the vulnerable code. Administrators should review the kernel version running on systems that use mlx5e devices for IPsec offload and verify whether the fix commit has been integrated.", "description_and_impact": "The vulnerability is a race condition in the Linux kernel\u2019s mlx5e driver when updating the Extended Sequence Number (ESN) used for IPsec full offload. After the driver validates an ESN wrap event, it temporarily releases the xfrm state lock, and if a second event arrives before the driver re\u2011sets the arm bit, the ESN high\u2011order bits are incremented incorrectly. The resulting invalid ESN state causes anti\u2011replay checks to fail, leading to a complete halt of IPsec traffic, effectively denying service to connections that rely on hardware\u2011accelerated IPsec.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests a low exploitation likelihood. The issue is not listed in the CISA KEV catalog, indicating no widespread known exploitation. This race condition corresponds to CWE-362 (Race Condition) and CWE-367 (Atomic Operations). It is triggered by hardware\u2011generated ESN events, implying that an attacker would need the ability to generate sufficient IPsec traffic on a device with full offload capabilities, likely requiring local or privileged access. The risk remains high because the flaw can disrupt IPsec traffic, potentially affecting confidentiality and availability for affected connections."}}}}, "created": "2026-04-03T21:13:58.145447+00:00", "updated": "2026-04-28T09:00:06.534460+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}