Live › vulnerability › CVE-2026-98497
Go to dashboardIn the Linux kernel's mlx5e driver for Mellanox ConnectX NICs, IPv6 IPsec policy masks were installed in the wrong address fields when source and destination prefix lengths differ. The resulting hardware rule can miss traffic the policy should cover and match traffic outside it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux with a Mellanox mlx5 NIC doing IPv6 IPsec (XFRM) offload where policies use different source and destination prefix lengths. Hosts without mlx5 IPsec offload or without IPv6 IPsec policies are unlikely to be affected. Exact trigger conditions are unknown from sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: fix swapped IPv6 IPsec policy masks
IPv6 XFRM policies may use different source and destination prefix lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks independently, but setup_fte_addr6() installs each mask in the opposite address field.
When the prefix lengths differ, this makes the source match use the destination prefix and the destination match use the source prefix. The resulting hardware rule can both miss traffic covered by the policy and match traffic outside it.
Install each mask in its corresponding match field.
This page as .md · .json · in your agent: get_signal("CVE-2026-98497")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.