CVE-2026-43464

{"id": "CVE-2026-43464", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "72328f25755ee966724f46e3a0e8e59bef2091ba", "lessThan": "1106412414dc3ee62999115be10ca83199b02108", "versionType": "git"}, {"status": "affected", "version": "0049fd63881505566824e88cfa624638f921c808", "lessThan": "9488ee96b4f53d2aed474c744f0ed64f61d1dcc9", "versionType": "git"}, {"status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "c74557495efb4bd0adefdfc8678ecdbc82a06da3", "versionType": "git"}, {"status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "03cb50e5b74fce8bf6d92b860371b66253cf0f8d", "versionType": "git"}, {"status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa", "versionType": "git"}, {"status": "affected", "version": "d969645b9b7810289bf3c353ea06957373756b8e", "versionType": "git"}, {"status": "affected", "version": "6.6.115", "lessThan": "6.6.160", "versionType": "semver"}, {"status": "affected", "version": "6.12.56", "lessThan": "6.12.114", "versionType": "semver"}, {"status": "affected", "version": "6.17.6", "lessThan": "6.18", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T15:16:59.283", "references": [{"url": "https://git.kernel.org/stable/c/03cb50e5b74fce8bf6d92b860371b66253cf0f8d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1106412414dc3ee62999115be10ca83199b02108", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9488ee96b4f53d2aed474c744f0ed64f61d1dcc9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c74557495efb4bd0adefdfc8678ecdbc82a06da3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn't change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nSuch issue can be observed with the\ntest_xdp_native_adjst_tail_shrnk_data selftest when using a payload of\n3600 and shrinking by 256 bytes (an upcoming selftest patch): the last\nfragment gets released by the XDP code but doesn't get tracked by the\ndriver. This results in a negative pp_ref_count during page release and\nthe following splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n <TASK>\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5e: RX, Correcci\u00f3n del conteo de fragmentos multi-buffer XDP para RQ heredado\n\nLos programas XDP multi-buffer pueden modificar la disposici\u00f3n del buffer XDP cuando el programa llama a bpf_xdp_pull_data() o bpf_xdp_adjust_tail(). El commit referenciado en la etiqueta \u2019fixes\u2019 corrigi\u00f3 la suposici\u00f3n en el controlador mlx5 de que la disposici\u00f3n del buffer XDP no cambia durante la ejecuci\u00f3n de un programa. Sin embargo, esta correcci\u00f3n introdujo otro problema: los fragmentos descartados a\u00fan necesitan ser contados por parte del controlador para evitar problemas de conteo de referencias de fragmentos de p\u00e1gina.\n\nTal problema puede observarse con la autoprueba test_xdp_native_adjst_tail_shrnk_data al usar una carga \u00fatil de 3600 y reducir en 256 bytes (un parche de autoprueba pr\u00f3ximo): el \u00faltimo fragmento es liberado por el c\u00f3digo XDP pero no es rastreado por el controlador. Esto resulta en un pp_ref_count negativo durante la liberaci\u00f3n de p\u00e1gina y el siguiente splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n [TASK]\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x 1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nEste parche corrige el problema al realizar el conteo de fragmentos de p\u00e1gina en todos los fragmentos originales del buffer XDP para todas las acciones XDP relevantes (XDP_TX, XDP_REDIRECT y XDP_PASS). Esto es b\u00e1sicamente revertir al conteo original antes del commit en la etiqueta \u2019fixes\u2019.\n\nComo frag_page sigue apuntando a la cola original, el par\u00e1metro nr_frags para xdp_update_skb_frags_info() necesita ser calculado de una manera diferente para reflejar el nuevo nr_frags."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E81F0DE3-D6B1-41D7-B6E1-1B9D9E102EFA", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.115"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6635FA2E-5F6F-4D2C-8880-447F4C4951B7", "versionEndExcluding": "6.13", "versionStartIncluding": "6.12.56"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B7EFF9F-4A45-4CD5-85D2-F68BD7D7F5B3", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F718F75-20D5-4D17-B698-1D1BD5FDE294", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.18.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}