Linux kernel mlx5_core IPsec offload / eswitch mode interlock: TENANT ISOLATION: the acquire-SA path unconditionally

Impact

TENANT ISOLATION: the acquire-SA path unconditionally calls mlx5_eswitch_unblock_mode() without a matching block, underflowing the counter that is supposed to prevent eswitch mode transitions while IPsec offload is live. Once that interlock is broken, switchdev/legacy mode can be flipped out from under active offloads - and eswitch mode is what defines VF steering and isolation on the NIC. A remote packet is enough to start unwinding the enforcement point for tenant separation.

Who can reach it

Network-reachable, unauthenticated: a remote TCP SYN routed through an administrator-configured outbound IPsec policy reaches the vulnerable acquire-SA callback. No account on the host.

What to do

Upgrade the host kernel to 7.1 or a stable backport (6.18.34, 7.0.11). Rolling reboot of every node running mlx5 IPsec full offload. Interim: if you are not depending on hardware IPsec offload, disable it on the mlx5 interfaces (config change, no reboot) to take the path out of reach.

References