The vulnerability is a race condition in the Linux kernel’s mlx5e driver when updating the Extended Sequence Number (ESN) used for IPsec full offload. After the driver validates an ESN wrap event, it temporarily releases the xfrm state lock, and if a second event arrives before the driver re‑sets the arm bit, the ESN high‑order bits are incremented incorrectly. The resulting invalid ESN state causes anti‑replay checks to fail, leading to a complete halt of IPsec traffic, effectively denying service to connections that rely on hardware‑accelerated IPsec.

This flaw affects the Linux kernel driver for Mellanox/ConnectX devices (mlx5e) when IPsec full offload is enabled. No specific kernel release dates are supplied in the description, so the vulnerability may be present in any kernel version that includes the vulnerable code. Administrators should review the kernel version running on systems that use mlx5e devices for IPsec offload and verify whether the fix commit has been integrated.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% suggests low exploitation likelihood. The issue is not listed in the CISA KEV catalog, indicating no widespread known exploitation. The race condition is triggered by hardware‑generated ESN events, implying that an attacker would need the ability to generate sufficient IPsec traffic on a device with full offload capabilities, likely requiring local or privileged access. Therefore the risk is moderate, and prompt patching is recommended to avoid denial of IPsec service.