CRITICAL Introduced in 6.15
mlx5e IPsecMask Swap
CVE-2026-98497
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks independently, but setup_fte_addr6() installs each mask in the opposite address field. When the prefix lengths differ, this makes the source match use the destination prefix and the destination match use the source prefix. The resulting hardware rule can both miss traffic covered by the policy and match traffic outside it. Install each mask in its corresponding match field.
02KernelScan AI Analysis
Risk summary
A logic error in the Mellanox mlx5e driver's IPv6 IPsec hardware offload causes source and destination policy masks to be swapped when programming flow rules. This allows network attackers to bypass IPsec policy enforcement — traffic that should be protected may be sent in clear, unauthorized traffic may be accepted as legitimate, and legitimate traffic may be dropped. Systems with Mellanox ConnectX adapters using IPsec offload for IPv6 with asymmetric prefix lengths are affected.
Vulnerability analysis
The Mellanox mlx5e driver correctly calculates separate source and destination prefix masks for IPv6 IPsec policies, but when programming the hardware flow rules it installs each mask in the wrong address field — the source mask goes to the destination field and vice versa. When a policy uses different prefix lengths for source and destination, the hardware matches the wrong address bits. This causes both false negatives, where legitimate traffic covered by the policy misses the rule and may be dropped or sent without IPsec protection, and false positives, where traffic outside the policy matches the rule and may be incorrectly accepted as protected traffic. The fix corrects the mask assignments. An attacker on the network can exploit this by crafting IPv6 packets with addresses that fall into the gap between the correct and swapped prefix boundaries, requiring only network access to the affected interface and no local privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.55 | 3803dc8477f0 |
| 7.2 | 6.15 | 7.2.9 | e73f832f0a7b |
| mainline | 6.15 | 7.3 | 10de7ed8ef48 |