---
id: CVE-2026-23441
title: 'net/mlx5e: Prevent concurrent access to IPSec ASO context'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Prevent concurrent access to IPSec ASO context

  The query or updating IPSec offload object is through Access ASO WQE.
  The driver uses a single mlx5e_ipsec_as…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1ed78fc033074c55221a80498204c539a3696877 <
    99aaee927800ea00b441b607737f9f67b1899755
  - >-
    Linux >= 1ed78fc033074c55221a80498204c539a3696877 <
    c3db55dc0f3344b62da25b025a8396d78763b5fa
  - >-
    Linux >= 1ed78fc033074c55221a80498204c539a3696877 <
    2c6a5be0aee5a44066f68a332c30650900e32ad4
  - >-
    Linux >= 1ed78fc033074c55221a80498204c539a3696877 <
    6834d196107d5267dcad31b44211da7698e8f618
  - >-
    Linux >= 1ed78fc033074c55221a80498204c539a3696877 <
    99b36850d881e2d65912b2520a1c80d0fcc9429a
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:31:00.143226Z'
published: '2026-04-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:46.994Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23441'
references:
  - url: 'https://git.kernel.org/stable/c/99aaee927800ea00b441b607737f9f67b1899755'
  - url: 'https://git.kernel.org/stable/c/c3db55dc0f3344b62da25b025a8396d78763b5fa'
  - url: 'https://git.kernel.org/stable/c/2c6a5be0aee5a44066f68a332c30650900e32ad4'
  - url: 'https://git.kernel.org/stable/c/6834d196107d5267dcad31b44211da7698e8f618'
  - url: 'https://git.kernel.org/stable/c/99b36850d881e2d65912b2520a1c80d0fcc9429a'
tags:
  - cve.org
epss: 0.00092
epssPercentile: 0.00508
ingestedAt: '2026-11-05T22:38:32.133Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent concurrent access to IPSec ASO context

The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.

A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.

When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.

This commit fixes the race by introducing a private context within
each IPSec offload object. The shared ASO context is now copied to
this private context while the ASO spinlock is held. Subsequent
processing uses this saved, per-object context, ensuring its integrity
is maintained.

## Affected

- `Linux >= 1ed78fc033074c55221a80498204c539a3696877 < 99aaee927800ea00b441b607737f9f67b1899755`
- `Linux >= 1ed78fc033074c55221a80498204c539a3696877 < c3db55dc0f3344b62da25b025a8396d78763b5fa`
- `Linux >= 1ed78fc033074c55221a80498204c539a3696877 < 2c6a5be0aee5a44066f68a332c30650900e32ad4`
- `Linux >= 1ed78fc033074c55221a80498204c539a3696877 < 6834d196107d5267dcad31b44211da7698e8f618`
- `Linux >= 1ed78fc033074c55221a80498204c539a3696877 < 99b36850d881e2d65912b2520a1c80d0fcc9429a`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.