net/mlx5: Fix crash when moving to switchdev mode

{
  "id": "ffe68e3fb4e607095db1440f24501817e40907b5eb9e89aee0feda6064e15ae1",
  "url": "https://osv.dev/vulnerability/CVE-2026-43467",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "net/mlx5: Fix crash when moving to switchdev mode",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix crash when moving to switchdev mode When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources. [27642.515799] WARNING: arch/x86/mm/fault.c:1276 at do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core [27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted 6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE [27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680 [27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22 00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d 41 [27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046 [27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88810b980f00 [27642.530158] RDX: 00000000000",
    "evidence": "osv:CVE-2026-43467",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.12.78",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.19",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.9",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-43467",
      "aliases": [
        "CVE-2026-43467"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7e212cebc863c2c7a82f480446cd731721451691"
                },
                {
                  "fixed": "05c9a6df3646cdd25e0e10e6ef2d20cdba3ed8f9"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "664f76be38a18c61151d0ef248c7e2f3afb4f3c7"
                },
                {
                  "fixed": "835778685f157b4fd4683b670cfe4010265bac60"
                },
                {
                  "fixed": "bc72f739f398d9d2e4f3d06f3f75fe98876d5579"
                },
                {
                  "fixed": "24b2795f9683e092dc22a68f487e7aaaf2ddafea"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.12.56"
                },
                {
                  "fixed": "6.12.78"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.17.6"
                },
                {
                  "fixed": "6.18"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8956686d398eca6d324d2d164f9d2a281175a3a1"
                }
              ]
            }
          ],
          "versions": [
            "v6.12.77",
            "v6.12.76",
            "v6.12.75",
            "v6.12.74",
            "v6.12.73",
            "v6.12.72",
            "v6.12.71",
            "v6.12.70",
            "v6.12.69",
            "v6.12.68",
            "v6.12.67",
            "v6.12.66",
            "v6.12.65",
            "v6.12.64",
            "v6.12.63",
            "v6.12.62",
            "v6.12.61",
            "v6.12.60",
            "v6.12.59",
            "v6.12.58",
            "v6.12.57",
            "v6.12.56",
            "v6.17.13",
            "v6.17.12",
            "v6.17.11",
            "v6.17.10",
            "v6.17.9",
            "v6.17.8",
            "v6.17.7",
            "v6.17.6"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43467.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.12.78"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.19"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.18.0"
                },
                {
                  "fixed": "6.19.9"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43467.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.184896058Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/05c9a6df3646cdd25e0e10e6ef2d20cdba3ed8f9",
        "https://git.kernel.org/stable/c/24b2795f9683e092dc22a68f487e7aaaf2ddafea",
        "https://git.kernel.org/stable/c/835778685f157b4fd4683b670cfe4010265bac60",
        "https://git.kernel.org/stable/c/bc72f739f398d9d2e4f3d06f3f75fe98876d5579",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43467.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-43467",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43467.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-43467",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 489408,
  "published_at": "2026-05-08T14:22:28.216+00:00"
}