CVE-2026-43199: Linux Kernel Race Condition Vulnerability

CVE-2026-43199 Overview

CVE-2026-43199 is a Linux kernel vulnerability in the net/mlx5e Mellanox Ethernet driver. The flaw triggers a "scheduling while atomic" bug inside mlx5e_ipsec_init_macs(). The function calls mlx5_query_mac_address(), which executes a hardware command through mlx5_cmd_exec() that can sleep. The call originates from the mlx5e_ipsec_handle_event workqueue, which runs in atomic context.

The upstream fix replaces the hardware query with ether_addr_copy(), reading the MAC address directly from netdev->dev_addr to avoid the sleeping call.

Critical Impact
A sleeping call from atomic context can produce kernel warnings, scheduler instability, and potential denial-of-service conditions on systems using mlx5 IPsec offload.

Affected Products

Linux kernel builds containing the mlx5_core driver with IPsec offload support
Systems using Mellanox/NVIDIA ConnectX adapters with net/mlx5e IPsec acceleration
Stable kernel branches prior to the commits referenced in the upstream fix

Discovery Timeline

2026-05-06 - CVE-2026-43199 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43199

Vulnerability Analysis

The defect resides in mlx5e_ipsec_init_macs() within the Mellanox 5th-generation Ethernet driver. During IPsec transform attribute construction, the function retrieves the local MAC address by calling mlx5_query_mac_address(). That helper invokes mlx5_query_nic_vport_mac_address(), which dispatches a firmware command through mlx5_cmd_exec() and waits on a completion via __wait_for_common() and schedule_timeout().

The execution path begins in mlx5e_ipsec_handle_event, scheduled through process_one_work on a kernel workqueue. Although workqueue handlers normally run in process context, the surrounding code path holds a spinlock or otherwise disables preemption, placing the thread in atomic context. Sleeping in this state violates kernel scheduling invariants and triggers the BUG: scheduling while atomic warning observed in the call trace.

Root Cause

The root cause is an unnecessary firmware round-trip to obtain data already cached in the kernel. The local MAC address is maintained in netdev->dev_addr and accessible without sleeping. The driver should have read this field directly instead of issuing a synchronous command to the device. This is a classic locking/context misuse defect [CWE-667] rather than a memory safety issue.

Attack Vector

The issue is triggered by IPsec event handling on the mlx5e workqueue, not by an external network input. A local condition that causes IPsec offload events while the relevant lock is held will reproduce the bug. The vulnerability manifests as kernel instability rather than memory corruption or privilege escalation. Refer to the upstream commits for the precise code path and patched diff.

The vulnerability is described in prose because no verified exploit code exists. See the Linux Kernel Commit 546de94 and Linux Kernel Commit e1407fb for the patch contents.

Detection Methods for CVE-2026-43199

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic referencing kworker threads.
Stack traces including mlx5e_ipsec_init_macs, mlx5_query_mac_address, and mlx5e_ipsec_handle_event from the mlx5_core module.
Sporadic IPsec offload failures or workqueue stalls on hosts with ConnectX adapters.

Detection Strategies

Monitor dmesg and /var/log/kern.log for scheduling-while-atomic warnings tied to mlx5_core.
Inventory running kernel versions across hosts with mlx5 NICs and compare against the patched stable releases referenced in the upstream commits.
Correlate IPsec session change events with kernel warning bursts to identify reproducible triggers.

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized logging or SIEM platform for pattern matching on scheduling while atomic.
Alert on repeated mlx5_core warnings in workqueue handlers, which can precede service degradation.
Track NIC and IPsec offload health metrics on hosts running affected kernels.

How to Mitigate CVE-2026-43199

Immediate Actions Required

Identify Linux hosts running mlx5_core with IPsec offload enabled and prioritize patching.
Apply the stable kernel update that includes the fix replacing mlx5_query_mac_address() with ether_addr_copy() in mlx5e_ipsec_init_macs().
Reboot affected systems after kernel upgrade to load the fixed driver.

Patch Information

The fix has been merged into the upstream Linux stable tree across multiple branches. Reference commits: Linux Kernel Commit 546de94, Linux Kernel Commit 57957bc, Linux Kernel Commit 8593806, and Linux Kernel Commit e1407fb. Distribution-supplied kernels should pick up the change in their next stable backport cycle.

Workarounds

Where patching is not immediately feasible, consider disabling mlx5e IPsec hardware offload on affected hosts to avoid the vulnerable code path.
Restrict IPsec configuration changes during high-load periods to reduce the rate at which mlx5e_ipsec_handle_event is invoked.
Track stable kernel announcements and schedule a maintenance window to deploy the fixed kernel as soon as it becomes available from the distribution vendor.

bash

# Check loaded mlx5 driver and running kernel
uname -r
lsmod | grep mlx5_core
dmesg | grep -i "scheduling while atomic"