CyberRota Analysis
AI-GeneratedA vulnerability in the Linux kernel affects the mlx5e driver, specifically in the handling of acquire-flow temporary Security Associations (SAs) for IPsec. This flaw can lead to a block underflow condition, potentially allowing unauthorized access or manipulation of network traffic. Organizations utilizing Linux systems with the mlx5e driver, particularly those implementing IPsec for secure communications, should prioritize patching this vulnerability to mitigate the associated risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.