CVE-2026-43467

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix crash when moving to switchdev mode

When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources.

[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at douseraddrfault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xtconntrack xtMASQUERADE ip6tablenat ip6tablefilter ip6tables iptablenat nfnat xtaddrtype rpcsecgsskrb5 authrpcgss oidregistry overlay mlx5fwctl nfnetlink zram zsmalloc mlx5ib fuse rpcrdma rdmaucm ibuverbs ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm mlx5core ibcore [27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted 6.19.0-rc5forupstreammindebug202601141647 #1 NONE [27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [27642.524528] RIP: 0010:douseraddrfault+0x18a/0x680 [27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22 00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d 41 [27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046 [27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88810b980f00 [27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI: ffff88810770f728 [27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09: 0000000000000000 [27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888103f3c4c0 [27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15: 0000000000000000 [27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000) knlGS:0000000000000000 [27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4: 0000000000172eb0 [27642.537982] Call Trace: [27642.538466] <TASK> [27642.538907] excpagefault+0x76/0x140 [27642.539583] asmexcpagefault+0x22/0x30 [27642.540282] RIP: 0010:rawspinlockirqsave+0x10/0x30 [27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8 01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8 5b [27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046 [27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX: ffff888113ad96d8 [27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI: 00000000000000a0 [27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09: ffff88810b980f00 [27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12: 00000000000000a8 [27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15: ffff8881130d8a40 [27642.550379] completeall+0x20/0x90 [27642.551010] mlx5eipsecdisableevents+0xb6/0xf0 [mlx5core] [27642.552022] mlx5enicdisable+0x12d/0x220 [mlx5core] [27642.552929] mlx5edetachnetdev+0x66/0xf0 [mlx5core] [27642.553822] mlx5enetdevchangeprofile+0x5b/0x120 [mlx5core] [27642.554821] mlx5evportrepload+0x419/0x590 [mlx5core] [27642.555757] ? xaload+0x53/0x90 [27642.556361] __eswoffloadsload_rep+0x54/0x70 [mlx5core] [27642.557328] mlx5eswoffloadsrepload+0x45/0xd0 [mlx5core] [27642.558320] eswoffloadsenable+0xb4b/0xc90 [mlx5core] [27642.559247] mlx5eswitchenablelocked+0x34e/0x4f0 [mlx5core] [27642.560257] ? mlx5rescandriverslocked+0x222/0x2d0 [mlx5core] [27642.561284] mlx5devlinkeswitchmodeset+0x5ac/0x9c0 [mlx5core] [27642.562334] ? devlinkratesetopssupported+0x21/0x3a0 [27642.563220] devlinknleswitchsetdoit+0x67/0xe0 [27642.564026] genlfamilyrcvmsgdoit+0xe0/0x130 [27642.564816] genlrcvmsg+0x183/0x290 [27642.565466] ? _devlinknlpredoit.isra.0+0x160/0x160 [27642.566329] ? d ---truncated---