CVE-2026-43199 - Vulnerability Details

- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by
replacing mlx5_query_mac_address() with ether_addr_copy() to get the
local MAC address directly from netdev->dev_addr.

The issue occurs because mlx5_query_mac_address() queries the hardware
which involves mlx5_cmd_exec() that can sleep, but it is called from
the mlx5e_ipsec_handle_event workqueue which runs in atomic context.

The MAC address is already available in netdev->dev_addr, so no need
to query hardware. This avoids the sleeping call and resolves the bug.

Call trace:
BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200
__schedule+0x7ab/0xa20
schedule+0x1c/0xb0
schedule_timeout+0x6e/0xf0
__wait_for_common+0x91/0x1b0
cmd_exec+0xa85/0xff0 [mlx5_core]
mlx5_cmd_exec+0x1f/0x50 [mlx5_core]
mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core]
mlx5_query_mac_address+0x19/0x30 [mlx5_core]
mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core]
mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core]
mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core]
process_one_work+0x178/0x2e0
worker_thread+0x2ea/0x430

Published: 2026-05-06

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s mlx5e IPsec driver, a scheduling violation occurs when the driver attempts to query a MAC address from the hardware while executing in an atomic context. The function used can sleep, which is disallowed in atomic context, causing the kernel to trigger a BUG. The patch replaces the hardware query with a direct copy of the MAC address from the device structure, eliminating the sleep operation and preventing the fault. The fixed flaw was reported as "scheduling while atomic" and the BUG could disrupt service on the host machine.

Affected Systems

The issue affects all Linux kernel installations that include the mlx5e driver with IPsec support and use the kernel before the fix is applied. No precise version range is specified, but the fix resides in the stable kernel tree, so any kernel that has not incorporated the commit would remain vulnerable. The material specific to vendor devices is not mentioned in the advisory.

Risk and Exploitability

The bug can trigger a local kernel BUG, which could potentially disrupt system operation. The CVSS score of 7.5 indicates high severity. The EPSS score is below 1% (0.00042), suggesting a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. There is no explicit enumeration of access requirements or attack vectors in the advisory, so it is unclear what privileges or conditions are needed to trigger the BUG. Consequently, the risk is considered severe, but the potential exploitability remains uncertain.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cee137a634318bfbda18ee5af45d300153b57fa5`	affected	< e1407fb7c337373dfaaae2445d828b0b9ae26a29
`cee137a634318bfbda18ee5af45d300153b57fa5`	affected	< 57957bc7f1865778ec9b1618e15515feb6df7eb4
`cee137a634318bfbda18ee5af45d300153b57fa5`	affected	< 546de94e41e92e1f7dc6213615fb7c794d05db98
`cee137a634318bfbda18ee5af45d300153b57fa5`	affected	< 859380694f434597407632c29f30fdb5e763e6cc

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cee137a634318bfbda18ee5af45d300153b57fa5,e1407fb7c337373dfaaae2445d828b0b9ae26a29)`	affected	code_commit	—
`[cee137a634318bfbda18ee5af45d300153b57fa5,57957bc7f1865778ec9b1618e15515feb6df7eb4)`	affected	code_commit	—
`[cee137a634318bfbda18ee5af45d300153b57fa5,546de94e41e92e1f7dc6213615fb7c794d05db98)`	affected	code_commit	—
`[cee137a634318bfbda18ee5af45d300153b57fa5,859380694f434597407632c29f30fdb5e763e6cc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that replaces the hardware MAC address query with a direct copy of the address (for example, the commit at https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98).
If a kernel update cannot be applied immediately, unload or disable the mlx5e IPsec module to prevent the workqueue from running the problematic code.
Continuously monitor kernel logs such as dmesg or system logs for "scheduling while atomic" or BUG messages, and investigate any incidents.

Generated by OpenCVE AI on May 11, 2026 at 23:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00055.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98
https://git.kernel.org/stable/c/57957bc7f1865778ec9b1618e15515feb6df7eb4
https://git.kernel.org/stable/c/859380694f434597407632c29f30fdb5e763e6cc
https://git.kernel.org/stable/c/e1407fb7c337373dfaaae2445d828b0b9ae26a29
https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43199-6376@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43199
https://www.cve.org/CVERecord?id=CVE-2026-43199

History

Mon, 11 May 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-368
References		https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43199-6376@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43199 https://www.cve.org/CVERecord?id=CVE-2026-43199
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy() to get the local MAC address directly from netdev->dev_addr. The issue occurs because mlx5_query_mac_address() queries the hardware which involves mlx5_cmd_exec() that can sleep, but it is called from the mlx5e_ipsec_handle_event workqueue which runs in atomic context. The MAC address is already available in netdev->dev_addr, so no need to query hardware. This avoids the sleeping call and resolves the bug. Call trace: BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200 __schedule+0x7ab/0xa20 schedule+0x1c/0xb0 schedule_timeout+0x6e/0xf0 __wait_for_common+0x91/0x1b0 cmd_exec+0xa85/0xff0 [mlx5_core] mlx5_cmd_exec+0x1f/0x50 [mlx5_core] mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core] mlx5_query_mac_address+0x19/0x30 [mlx5_core] mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core] mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core] mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core] process_one_work+0x178/0x2e0 worker_thread+0x2ea/0x430
Title		net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98 https://git.kernel.org/stable/c/57957bc7f1865778ec9b1618e15515feb6df7eb4 https://git.kernel.org/stable/c/859380694f434597407632c29f30fdb5e763e6cc https://git.kernel.org/stable/c/e1407fb7c337373dfaaae2445d828b0b9ae26a29

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:06.232Z

Updated: 2026-05-11T22:19:45.756Z

Reserved: 2026-05-01T14:12:55.992Z

Link: CVE-2026-43199

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-06T12:16:38.970

Modified: 2026-05-11T20:12:24.760

Link: CVE-2026-43199

Redhat

Severity : Moderate

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43199 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-11T23:30:02Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object