Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processed

Impact

The extended-sequence-number wrap event can be processed twice because the arm flag is re-set too late while the xfrm state lock is dropped and retaken. The driver then programs invalid ESN state, anti-replay fails, and all IPsec traffic on that SA halts. Operationally this is a stall of encrypted east-west traffic, not a memory-safety bug - but on an encrypted fabric it looks like a hard partition.

Who can reach it

Remote and unauthenticated in effect: an IPsec peer driving enough traffic to wrap the sequence number reaches the race. No credentials on the host.

What to do

Upgrade the host kernel to 7.0 or a stable backport (6.6.130, 6.12.78, 6.18.20, 6.19.10). Rolling reboot of IPsec-offload nodes. Interim: shorten SA rekey intervals so ESN wrap is not reached, a config change on the IKE daemon.

References