Answer in brief
CVE-2026-23441 records a Unknown severity vulnerability in net/mlx5e: Prevent concurrent access to IPSec ASO context. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1ed78fc033074c55221a80498204c539a3696877 <99aaee927800ea00b441b607737f9f67b1899755 || >=1ed78fc033074c55221a80498204c539a3696877 <c3db55dc0f3344b62da25b025a8396d78763b5fa || >=1ed78fc033074c55221a80498204c539a3696877 <2c6a5be0aee5a44066f68a332c30650900e32ad4 || >=1ed78fc033074c55221a80498204c539a3696877 <6834d196107d5267dcad31b44211da7698e8f618 || >=1ed78fc033074c55221a80498204c539a3696877 <99b36850d881e2d65912b2520a1c80d0fcc9429a | 99aaee927800ea00b441b607737f9f67b1899755, c3db55dc0f3344b62da25b025a8396d78763b5fa, 2c6a5be0aee5a44066f68a332c30650900e32ad4, 6834d196107d5267dcad31b44211da7698e8f618, 99b36850d881e2d65912b2520a1c80d0fcc9429a |
| Linux/Linuxgeneric | 6.2 | Not reported |
Published upstream
Apr 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context is now copied to this private context while the ASO spinlock is held. Subsequent processing uses this saved, per-object context, ensuring its integrity is maintained.
Quoted source text, attributed separately from HOL analysis.