CVE-2026-64522: Linux Kernel Privilege Escalation Flaw

CVE-2026-64522 Overview

CVE-2026-64522 is a Linux kernel vulnerability in the net/mlx5e driver affecting the Mellanox ConnectX Ethernet IPsec offload path. The flaw is a counter underflow in mlx5e_xfrm_add_state() when handling acquire-flow temporary Security Associations (SAs). The acquire path allocates software state and skips hardware offload setup, but jumps to a common success label that unconditionally calls mlx5_eswitch_unblock_mode(). This decrements esw->offloads.num_block_mode without a matching increment, corrupting the eswitch mode block accounting.

Critical Impact
Repeated acquire-SA operations underflow the eswitch mode block counter, potentially destabilizing eswitch mode transitions, IPsec offload state, and network availability on affected mlx5 devices.

Affected Products

Linux kernel net/mlx5e driver (mainline versions prior to fix commits)
Systems using Mellanox ConnectX adapters with IPsec offload enabled
Distributions shipping stable kernels prior to backport of commits abe003b3, b5bd4249, and ecafd828

Discovery Timeline

2026-07-25 - CVE-2026-64522 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64522

Vulnerability Analysis

The vulnerability resides in mlx5e_xfrm_add_state(), the driver entry point that installs XFRM Security Associations for IPsec offload on Mellanox mlx5 hardware. Acquire-flow SAs are transient states created by the kernel while userspace IKE negotiates keys. For these temporary SAs, the driver intentionally skips hardware offload programming and only installs a software handle.

After a refactor moved tunnel-mode validation earlier in the function, the acquire path continued to jump to the shared success label. That label unconditionally invokes mlx5_eswitch_unblock_mode(). Because the acquire path never called the paired mlx5_eswitch_block_mode(), each successful acquire-SA installation decrements esw->offloads.num_block_mode beyond its balanced value.

The counter tracks how many subsystems are currently blocking eswitch mode transitions. Once it underflows, blocking semantics break: a legitimate blocker can be released prematurely, or the eswitch may accept mode changes that should be rejected while IPsec offload state exists. This produces inconsistent driver state on production networking hardware.

Root Cause

The root cause is an unbalanced pair of block/unblock calls introduced when control flow was reorganized. The acquire branch bypasses mlx5_eswitch_block_mode() but shares an exit path that always calls mlx5_eswitch_unblock_mode(). This is a resource-accounting flaw [CWE-911, CWE-191] rather than a memory-safety bug.

Attack Vector

Exploitation requires the ability to trigger acquire-flow SA installation, typically via XFRM netlink or through IKE traffic that induces the kernel to create acquire states. An attacker with local privileges to configure IPsec, or a remote peer that can drive repeated acquire events on a listening endpoint, can force repeated underflows. The vulnerability affects integrity and availability of the network stack on affected devices. See the upstream fixes at kernel.org commit abe003b3, commit b5bd4249, and commit ecafd828.

The fix returns directly after installing the acquire SA offload handle, so only paths that successfully called mlx5_eswitch_block_mode() reach the matching unblock.

Detection Methods for CVE-2026-64522

Indicators of Compromise

Kernel log entries referencing mlx5_eswitch mode transitions occurring unexpectedly on hosts with active IPsec offload
Warnings or WARN_ON traces from mlx5_eswitch_unblock_mode() indicating counter inconsistencies
Unexpected switchdev/legacy eswitch mode changes on Mellanox ConnectX adapters while XFRM SAs are installed

Detection Strategies

Audit installed kernel versions against the stable trees containing the three fix commits
Monitor XFRM netlink activity for high-frequency acquire-SA creation from non-privileged contexts
Correlate mlx5 driver warnings with IPsec configuration changes in host telemetry

Monitoring Recommendations

Ingest dmesg and journald kernel logs into a centralized SIEM and alert on mlx5_eswitch or mlx5e_xfrm warnings
Track eswitch mode via devlink dev eswitch show on affected hosts and alert on unexpected transitions
Baseline XFRM SA counts using ip xfrm state count and flag anomalous growth in acquire states

How to Mitigate CVE-2026-64522

Immediate Actions Required

Apply the upstream stable kernel updates containing commits abe003b3, b5bd4249, and ecafd828
Prioritize patching on hosts using Mellanox ConnectX adapters with IPsec offload enabled
Restrict local access to XFRM netlink configuration to trusted administrators only

Patch Information

The fix returns directly after installing the acquire-SA software offload handle, ensuring mlx5_eswitch_unblock_mode() is only invoked on paths that previously called mlx5_eswitch_block_mode(). Fixes are available in the mainline and stable Linux kernel trees via commit abe003b3, commit b5bd4249, and commit ecafd828. Consult your distribution's security advisories for backported packages.

Workarounds

Disable IPsec crypto offload on mlx5 interfaces where feasible until the patched kernel is deployed
Avoid configurations that generate high volumes of acquire-flow SAs on affected hardware
Constrain CAP_NET_ADMIN on multi-tenant hosts to limit who can install XFRM states

bash

# Disable IPsec crypto offload on an affected mlx5 interface
ethtool -K eth0 esp-hw-offload off
ethtool -K eth0 esp-tx-csum-hw-offload off

# Verify current offload state
ethtool -k eth0 | grep esp