CVE-2026-23440 Linux CVE debrief

Who should care

Users of the Linux kernel, particularly those using IPSec full offload mode, should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of the kernel and ensuring that IPSec traffic is properly configured and monitored. The vulnerability has a high CVSS score, indicating a significant risk to affected systems.

Technical summary

The Linux kernel's IPSec implementation has a race condition during ESN updates in full offload mode. The driver's handling of ESN wrap events can cause the ESN high-order bits to be incremented incorrectly, leading to anti-replay failures and IPSec traffic halts. The fix involves re-arming the ESN event immediately after validation, before updating the xfrm state. This ensures that any spurious, duplicate events are correctly ignored, closing the race window. The vulnerability is resolved in the Linux kernel by updating the IPSec ESN handling to prevent incorrect ESN increments.

Defensive priority

High

Recommended defensive actions

• Update to a patched version of the Linux kernel
• Ensure IPSec traffic is properly configured and monitored
• Review and update IPSec configurations to prevent similar issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and affected versions of the Linux kernel. The source item URL provides additional information on the vulnerability and its mitigation. The issue is related to the IPSec full offload mode in the Linux kernel, and the fix involves re-arming the ESN event immediately after validation. The vulnerability has been resolved in the Linux kernel, and users should update to a patched version to mitigate the issue.

Official resources