CVE-2026-23441

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Apr 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux kernel networking code can let a local user cause network security processing to behave incorrectly on certain hardware, potentially disrupting encrypted traffic.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: High
Impact: Denial Of Service
Component: OS kernel
Class: Race Condition
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Race condition in mlx5e IPSec offload allows concurrent Access ASO WQE operations to overwrite a shared DMA-mapped context after the ASO spinlock is released, causing later completion handlers to read corrupted data and produce incorrect results.

Why it matters to the business

Networking hardware using certain Mellanox ConnectX adapters may experience unexpected IPSec offload failures, leading to degraded performance, packet drops, or system instability under concurrent IPSec workloads.

How an attack unfolds

A local attacker with low privileges triggers rapid, concurrent IPSec offload operations on the same PF so that one operation's DMA context is overwritten before the first operation completes, resulting in corrupted state when the completion is later processed.

How to fix it

Apply the upstream kernel commit that moves the ASO context to a per-object private buffer copied under the spinlock; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or binary; exercise concurrent IPSec offload workloads and confirm that no context corruption or unexpected results occur.

Typical attack path

Obtain local shell or userland process on an affected Linux host
Initiate multiple simultaneous IPSec offload operations against the mlx5e driver
Trigger the window where the shared ASO spinlock is released before hardware completion
Observe or induce incorrect IPSec behavior or crashes from the corrupted context

How to detect it

Review kernel logs for mlx5e IPSec errors or unexpected ASO completion values; examine crash dumps or oops traces involving the IPSec offload path; correlate with periods of high concurrent IPSec activity.

What your security team should do

Prioritize kernel updates on systems using mlx5e IPSec offload
Monitor vendor or distribution advisories for the exact fixed kernel versions
Restrict local access on high-value systems until patches are applied
Test IPSec performance after patching to ensure offload functionality

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context is now copied to this private context while the ASO spinlock is held. Subsequent processing uses this saved, per-object context, ensuring its integrity is maintained.

Affected packages

Ecosystem	Package	Introduced	Fixed