CVE-2026-23441

A flaw was found in the Linux kernel's net/mlx5e driver. A race condition occurs when the ASO spinlock is released prematurely, allowing concurrent operations to overwrite a shared Direct Memory Access (DMA) context. This can lead to the processing of corrupted data, resulting in unexpected behavior and incorrect results within the IPSec offload functionality.

This issue is limited to Mellanox ConnectX adapters using IPSec full offload with the shared ASO WQE path. Corrupted ASO context can break IPSec state or cause instability; exploitation for arbitrary code execution is not established. Systems without mlx5 or without IPSec offload are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.