A race condition exists in the Linux kernel’s mlx5e driver that manages IPSec offload objects. The driver uses a single shared context for all ASO operations, and the lock protecting this context is released before the hardware finishes processing a work queue entry. If a second operation begins immediately afterward, it overwrites the shared DMA area. When the first operation eventually completes, its completion handler reads the corrupted context, causing incorrect cryptographic results or unpredictable driver behavior. This flaw can corrupt secure traffic and may lead to kernel instability or service interruption.

All Linux kernels that compile with the mlx5e driver and enable IPSec offloading are vulnerable, up until the commit that introduces a private context per object. No specific kernel version numbers are identified, so the issue applies broadly to affected builds.

No CVSS or EPSS score is provided, and the vulnerability does not appear in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need at least local or privileged access to trigger multiple IPSec offload requests and cause the race. If achieved, the attacker could corrupt secured traffic or trigger a denial of service by destabilizing the kernel.