Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en_accel): The IPsec offload worker does not check the xfrm

Impact

The IPsec offload worker does not check the xfrm state's lifecycle before expiring it, so an SA that is already dead gets deleted a second time and the kernel dereferences poison list pointers. On a node where the fabric encryption terminates, this is a general protection fault that panics the host and takes every tenant on it offline.

Who can reach it

Requires mlx5 IPsec packet/full offload to be configured on the node (fabric-level encryption). The racing worker fires on SA soft/hard packet-count limits, so the timing window is opened by traffic volume across the tunnel - a fabric peer pushing traffic influences when it triggers - while SA teardown comes from the local IKE daemon. This is not a tenant-controlled primitive, but it is a peer-influenced panic on shared infrastructure.

What to do

Boot a kernel with the mlx5e IPsec state-check fix (stable commits below; no fixed-version list published for this ID). Interim control: if IPsec offload is not actually needed on a given node, run the fabric without mlx5 IPsec offload configured - the vulnerable worker is not scheduled when no offloaded SAs exist.

References