CVE-2026-43467: net/mlx5: Fix crash when moving to switchdev mode
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix crash when moving to switchdev mode
When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources.
[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at douseraddrfault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xtconntrack xtMASQUERADE ip6tablenat ip6tablefilter ip6tables iptablenat nfnat xtaddrtype rpcsecgsskrb5 authrpcgss oidregistry overlay mlx5fwctl nfnetlink zram zsmalloc mlx5ib fuse rpcrdma rdmaucm ibuverbs ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm mlx5core ibcore [27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted 6.19.0-rc5forupstreammindebug202601141647 #1 NONE [27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [27642.524528] RIP: 0010:douseraddrfault+0x18a/0x680 [27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22 00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d 41 [27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046 [27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88810b980f00 [27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI: ffff88810770f728 [27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09: 0000000000000000 [27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888103f3c4c0 [27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15: 0000000000000000 [27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000) knlGS:0000000000000000 [27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4: 0000000000172eb0 [27642.537982] Call Trace: [27642.538466] <TASK> [27642.538907] excpagefault+0x76/0x140 [27642.539583] asmexcpagefault+0x22/0x30 [27642.540282] RIP: 0010:rawspinlockirqsave+0x10/0x30 [27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8 01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8 5b [27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046 [27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX: ffff888113ad96d8 [27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI: 00000000000000a0 [27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09: ffff88810b980f00 [27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12: 00000000000000a8 [27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15: ffff8881130d8a40 [27642.550379] completeall+0x20/0x90 [27642.551010] mlx5eipsecdisableevents+0xb6/0xf0 [mlx5core] [27642.552022] mlx5enicdisable+0x12d/0x220 [mlx5core] [27642.552929] mlx5edetachnetdev+0x66/0xf0 [mlx5core] [27642.553822] mlx5enetdevchangeprofile+0x5b/0x120 [mlx5core] [27642.554821] mlx5evportrepload+0x419/0x590 [mlx5core] [27642.555757] ? xaload+0x53/0x90 [27642.556361] eswoffloadsloadrep+0x54/0x70 [mlx5core] [27642.557328] mlx5eswoffloadsrepload+0x45/0xd0 [mlx5core] [27642.558320] eswoffloadsenable+0xb4b/0xc90 [mlx5core] [27642.559247] mlx5eswitchenablelocked+0x34e/0x4f0 [mlx5core] [27642.560257] ? mlx5rescandriverslocked+0x222/0x2d0 [mlx5core] [27642.561284] mlx5devlinkeswitchmodeset+0x5ac/0x9c0 [mlx5core] [27642.562334] ? devlinkratesetopssupported+0x21/0x3a0 [27642.563220] devlinknleswitchsetdoit+0x67/0xe0 [27642.564026] genlfamilyrcvmsgdoit+0xe0/0x130 [27642.564816] genlrcvmsg+0x183/0x290 [27642.565466] ? devlinknlpredoit.isra.0+0x160/0x160 [27642.566329] ? d ---truncated---
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43467?
CVE-2026-43467 has a severity rating that can lead to potential crashes when switching to switchdev mode.
How do I fix CVE-2026-43467?
To fix CVE-2026-43467, ensure that your Linux kernel is updated to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43467?
CVE-2026-43467 affects the Linux kernel, specifically when moving to switchdev mode on devices that do not support IPsec.
Is CVE-2026-43467 a critical vulnerability?
CVE-2026-43467 is considered critical due to its ability to cause system crashes under specific conditions.
Does CVE-2026-43467 affect all Linux kernel versions?
CVE-2026-43467 impacts specific versions of the Linux kernel, particularly where switchdev mode is utilized without IPsec support.