{"id":"CVE-2026-64522","title":"net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA\n\nmlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating\nsoftware state and skipping har…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < b5bd4249e430f5963d559708ee96a671716d2400","Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < ecafd8284e527666e83261e6e57a7c7341d591cb","Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < abe003b33223ff33552f291644bf35d9c2f992fb","Linux 993c4ba71596c30418ba5a0ddcf4f9c2f431466a","Linux >= 6.17.4 < 6.18","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:41:33.468596Z"},"published":"2026-07-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:39.098Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64522","references":[{"url":"https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400"},{"url":"https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb"},{"url":"https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb"}],"tags":["cve.org"],"epss":0.00512,"epssPercentile":0.42341,"ingestedAt":"2026-10-16T17:24:46.825Z","slug":"CVE-2026-64522","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA\n\nmlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating\nsoftware state and skipping hardware offload setup.\n\nThat path jumps to the common success label before taking the eswitch mode\nblock. After tunnel-mode validation was moved earlier, the common success\nlabel unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,\nthis decrements esw->offloads.num_block_mode without a matching increment.\n\nReturn directly after installing the acquire SA offload handle, so only the\npaths that successfully called mlx5_eswitch_block_mode() call the matching\nunblock.\n\n## Affected\n\n- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < b5bd4249e430f5963d559708ee96a671716d2400`\n- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < ecafd8284e527666e83261e6e57a7c7341d591cb`\n- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < abe003b33223ff33552f291644bf35d9c2f992fb`\n- `Linux 993c4ba71596c30418ba5a0ddcf4f9c2f431466a`\n- `Linux >= 6.17.4 < 6.18`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}