High 7.5Published May 6, 2026

CVE-2026-43199net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query

Updated under an hour ago (Oct 27, 2026, 2:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy() to get the local MAC address directly from netdev->dev_addr. The issue occurs because mlx5_query_mac_address() queries the hardware which involves mlx5_cmd_exec() that can sleep, but it is called from the mlx5e_ipsec_handle_event workqueue which runs in atomic context. The MAC address is already available in netdev->dev_addr, so no need to query hardware. This avoids the sleeping call and resolves the bug. Call trace: BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200 __schedule+0x7ab/0xa20 schedule+0x1c/0xb0 schedule_timeout+0x6e/0xf0 __wait_for_common+0x91/0x1b0 cmd_exec+0xa85/0xff0 [mlx5_core] mlx5_cmd_exec+0x1f/0x50 [mlx5_core] mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core] mlx5_query_mac_address+0x19/0x30 [mlx5_core] mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core] mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core] mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core] process_one_work+0x178/0x2e0 worker_thread+0x2ea/0x430

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cee137a634318bfbda18ee5af45d300153b57fa5 before 5efde07521309274f26727860774614cbc187242; from cee137a634318bfbda18ee5af45d300153b57fa5 before e1407fb7c337373dfaaae2445d828b0b9ae26a29; from cee137a634318bfbda18ee5af45d300153b57fa5 before 57957bc7f1865778ec9b1618e15515feb6df7eb4; from cee137a634318bfbda18ee5af45d300153b57fa5 before 546de94e41e92e1f7dc6213615fb7c794d05db98; from cee137a634318bfbda18ee5af45d300153b57fa5 before 859380694f434597407632c29f30fdb5e763e6cc	CNA record
linux linux_kernel linux:linux_kernel	from 6.2 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 7.0	NVD

References

References

https://git.kernel.org/stable/c/5efde07521309274f26727860774614cbc187242
https://git.kernel.org/stable/c/e1407fb7c337373dfaaae2445d828b0b9ae26a29	patch
https://git.kernel.org/stable/c/57957bc7f1865778ec9b1618e15515feb6df7eb4	patch
https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98	patch
https://git.kernel.org/stable/c/859380694f434597407632c29f30fdb5e763e6cc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.