---
id: CVE-2026-64522
title: 'net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

  mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating
  software state and skipping har…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 <
    b5bd4249e430f5963d559708ee96a671716d2400
  - >-
    Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 <
    ecafd8284e527666e83261e6e57a7c7341d591cb
  - >-
    Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 <
    abe003b33223ff33552f291644bf35d9c2f992fb
  - Linux 993c4ba71596c30418ba5a0ddcf4f9c2f431466a
  - Linux >= 6.17.4 < 6.18
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:33.468596Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:39.098Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64522'
references:
  - url: 'https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400'
  - url: 'https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb'
  - url: 'https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb'
tags:
  - cve.org
epss: 0.00512
epssPercentile: 0.42341
ingestedAt: '2026-10-16T17:24:46.825Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating
software state and skipping hardware offload setup.

That path jumps to the common success label before taking the eswitch mode
block. After tunnel-mode validation was moved earlier, the common success
label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,
this decrements esw->offloads.num_block_mode without a matching increment.

Return directly after installing the acquire SA offload handle, so only the
paths that successfully called mlx5_eswitch_block_mode() call the matching
unblock.

## Affected

- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < b5bd4249e430f5963d559708ee96a671716d2400`
- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < ecafd8284e527666e83261e6e57a7c7341d591cb`
- `Linux >= 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 < abe003b33223ff33552f291644bf35d9c2f992fb`
- `Linux 993c4ba71596c30418ba5a0ddcf4f9c2f431466a`
- `Linux >= 6.17.4 < 6.18`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.