In the Linux kernel, the mlx5e network driver incorrectly applied IPv6 IPsec policy masks by installing the source mask into the destination field and vice versa when the prefix lengths differed. This mask misassignment can cause hardware rules to miss traffic that should be encrypted or to allow traffic that should be blocked, effectively undermining the intended IPsec protection. The flaw does not lead to remote code execution; its primary impact is the potential loss of confidentiality due to policy bypass or the loss of availability when legitimate packets are dropped.

Any system running a Linux kernel that includes the mlx5e driver is affected. The vendor is Linux, and no specific kernel version range is provided in the advisory. Users running older kernels that do not yet incorporate the fix should update the kernel or otherwise mitigate the issue.

The vulnerability has a CVSS score of 7.5, indicating high severity, and an EPSS score of < 1%, meaning the probability of exploitation is very low. The CVE is not listed in the CISA KEV catalog. The likely attack vector is remote network traffic that traverses the affected host; the exploit requires crafting IPv6 packets whose source and destination prefix lengths differ. An attacker could bypass IPsec enforcement or cause a denial of service by manipulating traffic to trigger the swapped mask logic. Overall, the risk is high in terms of confidentiality and availability but low in exploitation likelihood.