A race condition in the Linux kernel mlx5e driver allows an attacker to trigger duplicate IPSec Extended Sequence Number (ESN) wrap events. When the driver validates an ESN event, it temporarily releases and reacquires an internal lock while updating the kernel’s xfrm state. If a second event arrives before the lock is re‑acquired, the high‑order ESN bits are incremented incorrectly, leading the driver to program the hardware with a corrupted state. This corrupt state causes anti‑replay checks to fail and results in a complete halt of IPSec traffic on the affected interface. The flaw does not enable arbitrary code execution but does break secure communications by interrupting or preventing IPSec traffic.

The vulnerability applies to Linux kernel releases that include the mlx5e networking driver when IPSec full offload mode is enabled. No specific kernel versions are listed in the CVE data, so all kernels that ship with this driver and support the feature are potentially affected. Operating systems that rely on this driver for offloaded IPSec should review their kernel version against the commit that applies the fix.

The risk level is moderate for systems that rely heavily on IPSec offload, as a successful exploitation would disrupt secure communications but would not compromise system integrity or confidentiality beyond the affected traffic. For environments with no IPSec offload, the risk is negligible. Awareness that the flaw is a race condition explains that multiple rapid event deliveries are needed to trigger the issue, which may reduce the likelihood of random exploitation in typical traffic patterns.