CVE-2026-23441: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23441 is a race condition vulnerability in the Linux kernel's net/mlx5e IPSec offload driver that can lead to denial of service. The flaw affects Linux kernel versions 6.2 through multiple stable branches, specifically 6.2.1–6.6.129, 6.7–6.12.77, and 6.13–6.18.19, as well as 6.19.x before 6.19.10 and 7.0 release candidates prior to rc5. It was published on April 3, 2026, with patches released across multiple stable kernel trees. The CVSS v3.1 base score is 4.7 (Medium) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The net/mlx5e driver uses a single mlx5e_ipsec_aso struct per physical function (PF), which contains a shared DMA-mapped context for all ASO (Access Stream Operations) operations. The race condition arises because the ASO spinlock is released before the hardware finishes processing the Work Queue Entry (WQE); if a second IPSec operation begins immediately after, it overwrites the shared DMA context. When the first operation's completion is later processed, it reads the now-corrupted context, producing incorrect results or unexpected behavior (GitHub Advisory, Feedly).

Successful exploitation can cause data integrity failures in IPSec offload processing and potential denial of service conditions on systems using Mellanox mlx5 network adapters with IPSec hardware offload enabled. The vulnerability does not expose confidential data or allow integrity modification of arbitrary system resources, but incorrect IPSec processing outcomes could undermine the security guarantees of IPSec-protected network traffic. The scope is limited to the local system and does not facilitate lateral movement (Feedly).

Update the Linux kernel to one of the following patched versions: 6.6.130 or later (for 6.6.x series), 6.12.78 or later (for 6.12.x series), 6.18.20 or later (for 6.18.x series), 6.19.10 or later (for 6.19.x series), or 7.0-rc5 or later. The fix introduces a private context within each IPSec offload object; the shared ASO context is copied to this private context while the ASO spinlock is held, preventing concurrent access corruption. Patches are available via upstream kernel commits: c3db55dc, 99aaee92, 2c6a5be0, 6834d196, and 99b36850. Vendor-specific updates are available from SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) and Amazon Linux 2023 (ALAS2023-2026-1594) (GitHub Advisory, Feedly).