CVE-2026-43464
published 2026-05-08CVE-2026-43464: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ XDP multi-buf programs can…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.40%
32.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The
referenced commit in the fixes tag corrected the assumption in the mlx5
driver that the XDP buffer layout doesn't change during a program
execution. However, this fix introduced another issue: the dropped
fragments still need to be counted on the driver side to avoid page
fragment reference counting issues.
Such issue can be observed with the
test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of
3600 and shrinking by 256 bytes (an upcoming selftest patch): the last
fragment gets released by the XDP code but doesn't get tracked by the
driver. This results in a negative pp_ref_count during page release and
the following splat:
WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137
Modules linked in: [...]
CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]
[...]
Call Trace:
mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]
mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]
mlx5e_close_rq+0x50/0x60 [mlx5_core]
mlx5e_close_queues+0x36/0x2c0 [mlx5_core]
mlx5e_close_channel+0x1c/0x50 [mlx5_core]
mlx5e_close_channels+0x45/0x80 [mlx5_core]
mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]
mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]
netif_set_mtu_ext+0xf1/0x230
do_setlink.isra.0+0x219/0x1180
rtnl_newlink+0x79f/0xb60
rtnetlink_rcv_msg+0x213/0x3a0
netlink_rcv_skb+0x48/0xf0
netlink_unicast+0x24a/0x350
netlink_sendmsg+0x1ee/0x410
__sock_sendmsg+0x38/0x60
____sys_sendmsg+0x232/0x280
___sys_sendmsg+0x78/0xb0
__sys_sendmsg+0x5f/0xb0
[...]
do_syscall_64+0x57/
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 6.12.56 < 6.13 | 6.13 |
| linux | linux | >= 6.17.6 < 6.18 | 6.18 |
| linux | linux | >= 6.6.115 < 6.7 | 6.7 |
| linux | linux | >= afd5ba577c10639f62e8120df67dc70ea4b61176 < c74557495efb4bd0adefdfc8678ecdbc82a06da3 | c74557495efb4bd0adefdfc8678ecdbc82a06da3 |
| linux | linux | >= afd5ba577c10639f62e8120df67dc70ea4b61176 < 03cb50e5b74fce8bf6d92b860371b66253cf0f8d | 03cb50e5b74fce8bf6d92b860371b66253cf0f8d |
| linux | linux | >= afd5ba577c10639f62e8120df67dc70ea4b61176 < a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa | a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.12.56 < 6.13 | 6.13 |
| linux | linux_kernel | >= 6.17.6 < 6.18 | 6.18 |
| linux | linux_kernel | >= 6.18.1 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.19 < 6.19.9 | 6.19.9 |
| linux | linux_kernel | >= 6.6.115 < 6.7 | 6.7 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.18/6.19.8 mlx5e bpf_xdp_pull_data privilege escalation
vuldb·2026-05-21·CVSS 7.5
CVE-2026-43464 [HIGH] Linux Kernel up to 6.18.18/6.19.8 mlx5e bpf_xdp_pull_data privilege escalation
A vulnerability was found in Linux Kernel up to 6.18.18/6.19.8. It has been classified as problematic. This affects the function bpf_xdp_pull_data of the component mlx5e. This manipulation causes privilege escalation.
This vulnerability is tracked as CVE-2026-43464. The attack is only possible within the local network. No exploit exists.
Upgrading the affected component is recommended.
GHSA
GHSA-mf99-5486-2jh2: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
XDP multi-buf progr
ghsa_unreviewed·2026-05-08
CVE-2026-43464 GHSA-mf99-5486-2jh2: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
XDP multi-buf progr
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The
referenced commit in the fixes tag corrected the assumption in the mlx5
driver that the XDP buffer layout doesn't change during a program
execution. However, this fix introduced another issue: the dropped
fragments still need to be counted on the driver side to avoid page
fragment reference counting issues.
Such issue can be observed with the
test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of
3600 and shrinking by 256 bytes (an upcoming selftest patch): the last
fragment gets released by the XDP code but do
Red Hat
kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
vendor_redhat·2026-05-08·CVSS 7.0
CVE-2026-43464 [MEDIUM] CWE-911 kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
A flaw was found in the Linux kernel's mlx5e driver. When using eXpress Data Path (XDP) multi-buffer programs, an attacker could manipulate the XDP buffer layout. This manipulation leads to incorrect tracking of page fragments, causing a critical error in memory management. The issue can result in a system crash or denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel
No detection rules found.
No public exploits indexed.
2026-05-08
Published