Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en_accel): The IPsec offload worker does not check the xfrm

CVSS 6.5CVE-2024-49953Firmware, BMC & network fabriccurated

Impact

The IPsec offload worker does not check the xfrm state's lifecycle before expiring it, so an SA that is already dead gets deleted a second time and the kernel dereferences poison list pointers. On a node where the fabric encryption terminates, this is a general protection fault that panics the host and takes every tenant on it offline.

Who can reach it

Requires mlx5 IPsec packet/full offload to be configured on the node (fabric-level encryption). The racing worker fires on SA soft/hard packet-count limits, so the timing window is opened by traffic volume across the tunnel - a fabric peer pushing traffic influences when it triggers - while SA teardown comes from the local IKE daemon. This is not a tenant-controlled primitive, but it is a peer-influenced panic on shared infrastructure.

What to do

Boot a kernel with the mlx5e IPsec state-check fix (stable commits below; no fixed-version list published for this ID). Interim control: if IPsec offload is not actually needed on a given node, run the fabric without mlx5 IPsec offload configured - the vulnerable worker is not scheduled when no offloaded SAs exist.

References

https://git.kernel.org/stable/c/0b1672834634df9ac9cedf856db9fc36d92c50ef https://git.kernel.org/stable/c/151e7dead1f5399a73c19c4b50307ea48aff1dc0 https://nvd.nist.gov/vuln/detail/CVE-2024-49953

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.