What is the CVSS score of CVE-2026-64522?

CVE-2026-64522 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64522?

CVE-2026-64522 affects Linux systems running NVIDIA/Mellanox ConnectX network adapters with IPsec offload enabled, creating a kernel instability risk that could cause unplanned system crashes and…. A patch is available.

How to fix or mitigate CVE-2026-64522?

Within 24 hours, identify all Linux systems in production and development running the mlx5e driver with IPsec offload enabled by querying kernel logs and network hardware inventory. Within 7 days, test and validate the available stable kernel patch in non-production environments, confirming IPsec offload functionality remains intact post-patch. Within 30 days, execute a staged kernel update across production systems during planned maintenance windows, coordinate with infrastructure and operations teams, and monitor system stability logs post-deployment to confirm successful mitigation.

Linux Kernel CVE-2026-64522

EUVD-2026-48866 HIGH

2026-07-25 Linux

GHSA-x5f7-rh4c-gxvr

Information Disclosure Linux Red Hat Suse

High

Disputed · 8.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

4.4 MEDIUM

Requires local privileged XFRM/IPsec configuration (CAP_NET_ADMIN) on mlx5 hardware, so AV:L and PR:H; impact is counter/state corruption affecting availability only, hence C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 06:04 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

8.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 09:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 09:14 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA

mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup.

That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment.

Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock.

AnalysisAI

State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).

Technical ContextAI

The bug lives in drivers/net/ethernet/mellanox/mlx5 (mlx5e), the driver for NVIDIA/Mellanox ConnectX-family adapters, specifically its XFRM/IPsec crypto-offload integration. The eswitch (embedded switch, used for SR-IOV/switchdev offload) maintains a blocking counter, num_block_mode, that prevents mode changes while certain offloads are active; mlx5_eswitch_block_mode() increments it and mlx5_eswitch_unblock_mode() decrements it, so they must be balanced. IPsec 'acquire' SAs are transient software-only entries the kernel creates while negotiating a real SA, and this path intentionally skips hardware setup - but a prior refactor that moved tunnel-mode validation earlier left the shared success label calling unblock unconditionally. The result is an unbalanced decrement (integer/reference-counter underflow, a CWE-191/CWE-911-class lifecycle bug, although the feed lists CWE as N/A).

RemediationAI

Upstream fix available (commits/stable backports); apply the vendor-released stable kernel that contains commits ecafd8284e, abe003b332, and b5bd4249e4 - patched versions are reported as 6.18.34 and 7.0.11, and distro consumers should install the fixed package per Ubuntu USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1) and equivalent advisories from their vendor. As a compensating control until patched, avoid enabling mlx5 IPsec crypto offload / eswitch switchdev mode on affected hosts, or restrict CAP_NET_ADMIN so untrusted local users and containers cannot create XFRM/IPsec state on mlx5 interfaces; the trade-off is loss of hardware IPsec acceleration and reduced ability to administer networking, so this is only appropriate as a short-term measure. Reference the fix commits at https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400 and the two companion commits listed in the CVE references.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64522 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64522

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code