UBUNTU-CVE-2026-64522
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
6 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
2 explicit affected versions
10 explicit affected versions
26 explicit affected versions
7 explicit affected versions
13 explicit affected versions
35 explicit affected versions
1 explicit affected versions
18 explicit affected versions
1 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
7 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
9 explicit affected versions
16 explicit affected versions
6 explicit affected versions
10 explicit affected versions
37 explicit affected versions
11 explicit affected versions
13 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
26 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
8 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
17 explicit affected versions
5 explicit affected versions
10 explicit affected versions
26 explicit affected versions
11 explicit affected versions
10 explicit affected versions
13 explicit affected versions
16 explicit affected versions
10 explicit affected versions
3 explicit affected versions
7 explicit affected versions
51 explicit affected versions
18 explicit affected versions
12 explicit affected versions
7 explicit affected versions
27 explicit affected versions
3 explicit affected versions
8 explicit affected versions
8 explicit affected versions
3 explicit affected versions
5 explicit affected versions
8 explicit affected versions
6 explicit affected versions
10 explicit affected versions
7 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
7 explicit affected versions
4 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
13 explicit affected versions
43 explicit affected versions
16 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
11 explicit affected versions
1 explicit affected versions
6 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/abe003b33223ff33552f291644bf35d9c2f992fb
- https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb
- https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400
- https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb
- https://ubuntu.com/security/CVE-2026-64522
- https://ubuntu.com/security/notices/USN-8618-1
- https://www.cve.org/CVERecord?id=CVE-2026-64522