Linux kernel mlx5_core IPsec offload / eswitch mode interlock: The acquire-SA path unconditionally calls

CVSS 8.8CVE-2026-64522Firmware, BMC & network fabricnet/mlx5e eswitch mode block underflow on IPsec acquire SAcurated

Impact

The acquire-SA path unconditionally calls mlx5_eswitch_unblock_mode() without a matching block, underflowing the counter that is supposed to prevent eswitch mode transitions while IPsec offload is live. Once that interlock is broken, switchdev/legacy mode can be flipped out from under active offloads - and eswitch mode is what defines VF steering and isolation on the NIC. A remote packet is enough to start unwinding the enforcement point for tenant separation.

Who can reach it

Network-reachable, unauthenticated: a remote TCP SYN routed through an administrator-configured outbound IPsec policy reaches the vulnerable acquire-SA callback. No account on the host.

What to do

Upgrade the host kernel to 7.1 or a stable backport (6.18.34, 7.0.11). Rolling reboot of every node running mlx5 IPsec full offload. Interim: if you are not depending on hardware IPsec offload, disable it on the mlx5 interfaces (config change, no reboot) to take the path out of reach.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64522 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64522.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.