CVE-2026-98497

A flaw was found in the Linux kernel's mlx5 network driver. When configuring IPv6 IPsec (Internet Protocol Security) rules with differing source and destination prefix lengths, the driver inadvertently swaps the source and destination address masks installed into hardware flow tables. This incorrect rule configuration can allow an attacker to bypass IPsec security policies or cause traffic to be misclassified, potentially leading to unauthorized data transmission or network disruption.

This vulnerability is rated as having Moderate impact because exploitation requires specific Mellanox network hardware with hardware IPsec offload actively enabled alongside asymmetric IPv6 policy prefix configurations. In typical Red Hat Enterprise Linux deployments, IPsec cryptographic operations and policy evaluations are processed in software by default, limiting exposure to systems where hardware acceleration is deliberately provisioned on supported devices. Under vulnerable conditions, network traffic could bypass filtering rules or experience classification failures, but the blast radius is confined strictly to hardware-accelerated flows utilizing asymmetrical subnet definitions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.