CVE-2026-23440 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, system administrators, and security teams responsible for Linux systems using IPSec full offload mode should assess exposure and verify if their systems are affected. Those using affected versions should prioritize updating to a fixed kernel version.

Why it matters

This vulnerability in the Linux kernel's net/mlx5e driver can cause incorrect ESN values and potential IPSec connection instability in IPSec full offload mode. Linux kernel maintainers, distribution maintainers, and system administrators should assess exposure and prioritize updates or patches to address the issue.

• Incorrect ESN high-order bits incrementation due to double processing of ESN update events
• Potential for IPSec connection instability or security risks due to incorrect ESN values
• Need for kernel updates or patches to address the vulnerability
• Verification of IPSec configuration and system logs for unusual activity

Technical summary

The Linux kernel's net/mlx5e driver has a race condition vulnerability in IPSec ESN update handling. In IPSec full offload mode, the device reports an ESN wrap event, which the driver must validate and handle. However, a race condition exists when updating the kernel's xfrm state, potentially causing incorrect ESN high-order bits incrementation if the event is processed twice. This vulnerability can lead to IPSec connection instability and potential security risks. Linux kernel maintainers and users should assess exposure and verify if their systems are using the affected net/mlx5e functionality. Those using IPSec full offload mode are advised to update to a fixed kernel version as soon as available.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify if their systems are using the affected net/mlx5e functionality. Those using IPSec full offload mode are advised to update to a fixed kernel version as soon as available. Compensating controls, such as monitoring for unusual ESN updates, may be necessary until a fix is applied.

Recommended defensive actions

• Review Linux kernel versions and IPSec configurations for potential exposure
• Verify net/mlx5e usage and assess the need for updates or patches
• Monitor system logs for unusual ESN update activity
• Consider applying compensating controls until a fix is available
• Perform a thorough review of IPSec configurations and Linux kernel versions to identify potential exposure
• Track and verify the deployment of patches or updates to affected systems
• Continuously monitor for unusual activity or potential security risks associated with the vulnerability

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to kernel commits addressing the issue. However, specific version ranges and detailed impact assessments require verification from the official Linux kernel sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.