PT-2026-30135 · Mellanox+1 · Mlx5E+1

Published 2026-04-03 · Updated 2026-04-20 · CVE-2026-23440

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the handling of IPSec ESN (Extended Sequence Number) wrap events in the mlx5e driver when operating in IPSec full offload mode. After validating an ESN event, the driver calls mlx5 accel esp modify xfrm() to update the kernel's xfrm state, which temporarily releases and re-acquires the xfrm state lock. This creates a window where a duplicate ESN update could be processed. Processing the event twice causes incorrect incrementing of the ESN high-order bits (esn msb), leading to anti-replay failures and a complete halt of IPSec traffic. The fix involves re-arming the ESN event immediately after validation, before calling mlx5 accel esp modify xfrm(), to ensure duplicate events are ignored.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-23440

OESA-2026-1946

OESA-2026-1947

OESA-2026-1948

Affected Products

Linux Kernel

Mlx5E

References · 33

• https://git.kernel.org/stable/c/beb6e2e5976a128b0cccf10d158124422210c5ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23247 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68291 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23269 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23444 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31405 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31393 · Security Note
• https://git.kernel.org/stable/c/8d625c15471fb8780125eaef682983a96af77bdc · Patch
• https://ubuntu.com/security/CVE-2026-23440 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1948 · Vendor Advisory
• https://git.kernel.org/stable/c/96c9c25b74686ac2de15921c9ad30c5ef13af8cd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23389 · Security Note