Description
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by
replacing mlx5_query_mac_address() with ether_addr_copy() to get the
local MAC address directly from netdev->dev_addr.

The issue occurs because mlx5_query_mac_address() queries the hardware
which involves mlx5_cmd_exec() that can sleep, but it is called from
the mlx5e_ipsec_handle_event workqueue which runs in atomic context.

The MAC address is already available in netdev->dev_addr, so no need
to query hardware. This avoids the sleeping call and resolves the bug.

Call trace:
BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200
__schedule+0x7ab/0xa20
schedule+0x1c/0xb0
schedule_timeout+0x6e/0xf0
__wait_for_common+0x91/0x1b0
cmd_exec+0xa85/0xff0 [mlx5_core]
mlx5_cmd_exec+0x1f/0x50 [mlx5_core]
mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core]
mlx5_query_mac_address+0x19/0x30 [mlx5_core]
mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core]
mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core]
mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core]
process_one_work+0x178/0x2e0
worker_thread+0x2ea/0x430
Published: 2026-05-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel’s mlx5e IPsec driver, a scheduling violation occurs when the driver attempts to query a MAC address from the hardware while executing in an atomic context. The function used can sleep, which is disallowed in atomic context, causing the kernel to trigger a BUG and crash. The patch replaces the hardware query with a direct copy of the MAC address from the device structure, eliminating the sleep operation and preventing the fault. The fixed flaw was reported as "scheduling while atomic" and the crash would interrupt service on the host machine.

Affected Systems

The issue affects all Linux kernel installations that include the mlx5e driver with IPsec support and use the kernel before the fix is applied. No precise version range is specified, but the fix resides in the stable kernel tree, so any kernel that has not incorporated the commit would remain vulnerable. The material specific to vendor devices is not mentioned in the advisory.

Risk and Exploitability

The bug results in a local kernel panic, which is a severe denial‑of‑service condition. Though the CVSS score is not provided, the impact is high. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. There is no explicit enumeration of access requirements or attack vectors in the advisory, so it is unclear what privileges or conditions are needed to trigger the crash. Consequently, the risk is considered severe, but the potential exploitability cannot be precisely quantified based on the available data.

Generated by OpenCVE AI on May 6, 2026 at 16:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that replaces the hardware MAC address query with a direct copy of the address (for example, the commit at https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98).
  • If a kernel update cannot be applied immediately, unload or disable the mlx5e IPsec module to prevent the workqueue from running the problematic code.
  • Continuously monitor kernel logs such as dmesg or system logs for "scheduling while atomic" or BUG messages, and investigate any incidents.

Generated by OpenCVE AI on May 6, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 06 May 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy() to get the local MAC address directly from netdev->dev_addr. The issue occurs because mlx5_query_mac_address() queries the hardware which involves mlx5_cmd_exec() that can sleep, but it is called from the mlx5e_ipsec_handle_event workqueue which runs in atomic context. The MAC address is already available in netdev->dev_addr, so no need to query hardware. This avoids the sleeping call and resolves the bug. Call trace: BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200 __schedule+0x7ab/0xa20 schedule+0x1c/0xb0 schedule_timeout+0x6e/0xf0 __wait_for_common+0x91/0x1b0 cmd_exec+0xa85/0xff0 [mlx5_core] mlx5_cmd_exec+0x1f/0x50 [mlx5_core] mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core] mlx5_query_mac_address+0x19/0x30 [mlx5_core] mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core] mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core] mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core] process_one_work+0x178/0x2e0 worker_thread+0x2ea/0x430
Title net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-06T11:28:06.232Z

Reserved: 2026-05-01T14:12:55.992Z

Link: CVE-2026-43199

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-06T12:16:38.970

Modified: 2026-05-06T13:07:51.607

Link: CVE-2026-43199

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-06T17:15:08Z

Weaknesses

No weakness.