CVE-2026-23441
published 2026-04-03CVE-2026-23441: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec…
PriorityP418medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.09%
0.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.
A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.
When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.
This commit fixes the race by introducing a private context within
each IPSec offload object. The shared ASO context is now copied to
this private context while the ASO spinlock is held. Subsequent
processing uses this saved, per-object context, ensuring its integrity
is maintained.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 1ed78fc033074c55221a80498204c539a3696877 < 99aaee927800ea00b441b607737f9f67b1899755 | 99aaee927800ea00b441b607737f9f67b1899755 |
| linux | linux | >= 1ed78fc033074c55221a80498204c539a3696877 < c3db55dc0f3344b62da25b025a8396d78763b5fa | c3db55dc0f3344b62da25b025a8396d78763b5fa |
| linux | linux | >= 1ed78fc033074c55221a80498204c539a3696877 < 2c6a5be0aee5a44066f68a332c30650900e32ad4 | 2c6a5be0aee5a44066f68a332c30650900e32ad4 |
| linux | linux | >= 1ed78fc033074c55221a80498204c539a3696877 < 6834d196107d5267dcad31b44211da7698e8f618 | 6834d196107d5267dcad31b44211da7698e8f618 |
| linux | linux | >= 1ed78fc033074c55221a80498204c539a3696877 < 99b36850d881e2d65912b2520a1c80d0fcc9429a | 99b36850d881e2d65912b2520a1c80d0fcc9429a |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.2.1 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.78 | 6.12.78 |
| ubuntu | linux | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
| ubuntu | linux-gke | — | — |
| ubuntu | linux-gkeop | — | — |
| ubuntu | linux-realtime | — | — |
| ubuntu | linux-realtime-6.8 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-23441 [MEDIUM] CWE-821 kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.
A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.
When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.
This commit fixes the race by introducing a privat
Debian
CVE-2026-23441: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ...
vendor_debian·2026
CVE-2026-23441 [LOW] CVE-2026-23441: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ...
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context
OSV
CVE-2026-23441: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IP
osv·2026-04-03
CVE-2026-23441 CVE-2026-23441: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IP
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context
GHSA
GHSA-c26h-gxpc-728g: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating
ghsa_unreviewed·2026-04-03
CVE-2026-23441 GHSA-c26h-gxpc-728g: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.
A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.
When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.
This commit fixes the race by introducing a private context within
each IPSec offload object. The shared ASO con
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23441 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23441 CVE-2026-23441 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23441 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.
A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.
When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.
This commit fixes the race by introduci
Bugzilla
CVE-2026-23441 kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
bugzilla·2026-04-03·CVSS 4.7
CVE-2026-23441 [MEDIUM] CVE-2026-23441 kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
CVE-2026-23441 kernel: net/mlx5e: Prevent concurrent access to IPSec ASO context
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent concurrent access to IPSec ASO context
The query or updating IPSec offload object is through Access ASO WQE.
The driver uses a single mlx5e_ipsec_aso struct for each PF, which
contains a shared DMA-mapped context for all ASO operations.
A race condition exists because the ASO spinlock is released before
the hardware has finished processing WQE. If a second operation is
initiated immediately after, it overwrites the shared context in the
DMA area.
When the first operation's completion is processed later, it reads
this corrupted context, leading to unexpected behavior and incorrect
results.
This commit fixes the race by
https://git.kernel.org/stable/c/2c6a5be0aee5a44066f68a332c30650900e32ad4https://git.kernel.org/stable/c/6834d196107d5267dcad31b44211da7698e8f618https://git.kernel.org/stable/c/99aaee927800ea00b441b607737f9f67b1899755https://git.kernel.org/stable/c/99b36850d881e2d65912b2520a1c80d0fcc9429ahttps://git.kernel.org/stable/c/c3db55dc0f3344b62da25b025a8396d78763b5fa
2026-04-03
Published