CVE-2026-98497 Overview
CVE-2026-98497 is a Linux kernel vulnerability in the net/mlx5e driver that affects IPv6 IPsec policy handling. The setup_fte_addr6() function installs source and destination address masks in swapped match fields. When IPv6 XFRM policies use different source and destination prefix lengths, the resulting hardware flow steering rules misclassify traffic. Policies can both miss packets they should protect and match packets they should not. The flaw was corrected in the mainline kernel and backported through stable commits 10de7ed, 3803dc8, and e73f832.
Critical Impact
IPv6 IPsec policies on Mellanox ConnectX NICs using mlx5 hardware offload may fail to enforce correct traffic protection, exposing cleartext traffic or dropping legitimate flows.
Affected Products
- Linux kernel versions containing the mlx5e IPsec IPv6 offload code prior to the fix
- Systems using Mellanox ConnectX adapters with mlx5_core driver and IPsec full offload
- Distributions shipping stable kernels before backports 10de7ed8ef48, 3803dc8477f0, and e73f832f0a7b
Discovery Timeline
- 2026-10-18 - CVE-2026-98497 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98497
Vulnerability Analysis
The Linux kernel mlx5 Ethernet driver offloads IPsec policy enforcement to Mellanox NIC hardware using flow table entries (FTEs). For IPv6 policies, mlx5e_ipsec_policy_mask() constructs two address masks derived from the XFRM policy's source and destination prefix lengths. These masks are then written into the hardware match criteria by setup_fte_addr6().
The function installs the source mask into the destination match field and the destination mask into the source match field. When the XFRM policy specifies equal source and destination prefix lengths, the bug has no observable effect because both masks are identical. When the prefix lengths differ, the hardware rule enforces the wrong boundaries on each address.
The security consequence is twofold. Traffic that the administrator intended to protect under IPsec can bypass the policy and flow in cleartext. Conversely, traffic outside the policy's intended scope can be matched and processed, which may drop or misroute flows. Both outcomes break the confidentiality and integrity guarantees of the configured security association.
Root Cause
The root cause is a field-assignment error [CWE-840 Business Logic Error class] in setup_fte_addr6(). Each mask is placed into the opposite field of the flow steering match structure. The fix installs each mask in its corresponding match field.
Attack Vector
Exploitation does not require remote network access. The vulnerability manifests whenever a system administrator configures an IPv6 XFRM policy with asymmetric prefix lengths on a host using mlx5e hardware IPsec offload. An attacker aware of the misconfiguration can send traffic crafted to fall into the gap between the intended and actual match rules. See the upstream fixes at Linux Kernel Commit 10de7ed, Linux Kernel Commit 3803dc8, and Linux Kernel Commit e73f832.
Detection Methods for CVE-2026-98497
Indicators of Compromise
- Unexpected cleartext IPv6 traffic egressing an interface configured for IPsec offload with asymmetric prefix policies
- XFRM policy counters showing hits inconsistent with observed traffic patterns on mlx5-backed interfaces
- Dropped or unmatched IPv6 flows that correlate with recently installed XFRM policies using mixed /64, /96, or /128 prefix combinations
Detection Strategies
- Audit running kernels on hosts with Mellanox ConnectX adapters and compare build versions against the fixed stable commits
- Inspect active XFRM policies with ip -6 xfrm policy and flag any policy where source and destination prefix lengths differ
- Capture traffic on both sides of IPsec tunnels and verify that packets matching the configured selectors are encrypted as expected
Monitoring Recommendations
- Monitor kernel version inventory across Linux hosts using mlx5 drivers and track patch status centrally
- Correlate IPsec policy changes with subsequent traffic anomalies in network telemetry
- Alert on new XFRM policy installations that use asymmetric IPv6 prefixes until the host is confirmed patched
How to Mitigate CVE-2026-98497
Immediate Actions Required
- Identify hosts running affected Linux kernel versions with mlx5e IPsec offload enabled
- Apply the stable kernel update that includes commits 10de7ed, 3803dc8, or e73f832 for your kernel branch
- Reboot patched systems and verify IPv6 XFRM policies install correctly after the upgrade
Patch Information
The upstream fix adjusts setup_fte_addr6() to install each mask in its corresponding match field. Backports are available in the stable tree via Linux Kernel Commit 10de7ed, Linux Kernel Commit 3803dc8, and Linux Kernel Commit e73f832. Distribution vendors are expected to ship the fix in their next kernel updates.
Workarounds
- Disable mlx5e IPsec full offload and fall back to software XFRM processing until the kernel is patched
- Reconfigure affected XFRM policies to use identical source and destination prefix lengths, which avoids triggering the swap
- Restrict IPv6 IPsec policy configuration on affected hosts to administrators who understand the offload limitation
# Verify kernel version and inspect IPv6 XFRM policies for asymmetric prefixes
uname -r
ip -6 xfrm policy | grep -E 'src|dst'
# Disable IPsec crypto offload on an mlx5 interface as a temporary workaround
ethtool -K <ifname> esp-hw-offload off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
