CVE-2026-23440: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23440 is a race condition vulnerability in the Linux kernel's MLX5 network driver affecting IPSec Extended Sequence Number (ESN) handling in full offload mode. It was published on April 3, 2026, and affects Linux kernel versions 6.4.1 through 6.6.129, 6.7 through 6.12.77, 6.13 through 6.18.19, and 6.19 through 6.19.9, as well as Linux kernel 7.0 release candidates. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Github Advisory).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). In IPSec full offload mode, when the MLX5 hardware reports an ESN wrap event, the driver validates it by checking that the esn_event_arm field is 0x0. The driver then calls mlx5_accel_esp_modify_xfrm() to update the kernel's xfrm state, but this function temporarily releases and re-acquires the xfrm state lock, creating a window during which a duplicate ESN event can be processed. Processing the event twice causes the ESN high-order bits (esn_msb) to be incorrectly incremented, after which the driver programs the hardware with an invalid ESN state. The fix re-arms the ESN event (setting esn_event_arm back to 0x1) immediately after validation and before calling mlx5_accel_esp_modify_xfrm(), closing the race window (Github Advisory).

Successful exploitation causes corruption of the IPSec security association state, leading to anti-replay failures and a complete halt of IPSec-encrypted network traffic — effectively a denial of service for encrypted communications. The impact is limited to availability (no confidentiality or integrity loss), and exploitation requires local access with low privileges on a system using MLX5 hardware with IPSec full offload enabled. Systems relying on IPSec for secure network communications, such as VPN gateways or encrypted data center interconnects using Mellanox/NVIDIA MLX5 NICs, are most at risk (Github Advisory).

Update the Linux kernel to a patched version: 6.6.130 or later, 6.12.78 or later, 6.18.20 or later, or 6.19.10 or later, depending on the currently deployed branch. Patches are available via five upstream kernel commits: 2051c709, 3dffc083, 8d625c15, 96c9c25b, and beb6e2e5. If immediate patching is not feasible, disabling IPSec hardware offloading on affected MLX5 devices is a viable temporary workaround. Distributions including SUSE, openSUSE, Amazon Linux 2023, and Yocto Project have issued security advisories with updated packages (Github Advisory).

SUSE issued security advisories (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) addressing this vulnerability, and Amazon Linux 2023 published advisory ALAS2023-2026-1594. The Yocto Project security mailing list also discussed the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch notifications.