CVE-2026-43466
published 2026-05-08CVE-2026-43466: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a…
PriorityP343high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.33%
25.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,
desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old
dma_fifo_pc, while the consumer reads from position 0.
This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart.
At the point of reset, all WQEs have been flushed so dma_fifo_cc is
already equal to dma_fifo_pc. There is no need to reset either counter,
similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the following WARNING:
WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 4
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 821f85d619f7f22cda7b9d7de89cf5eeb1d11544 | 821f85d619f7f22cda7b9d7de89cf5eeb1d11544 |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 6eb68ecc5acc3b319986566c595990b8a7265b23 | 6eb68ecc5acc3b319986566c595990b8a7265b23 |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e | 6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 383b37c04a4827ba60b2bafc1a6cdfd995aed58f | 383b37c04a4827ba60b2bafc1a6cdfd995aed58f |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8 | 9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8 |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < ce1b19dd0684eeb68a124c11085bd611260b36d9 | ce1b19dd0684eeb68a124c11085bd611260b36d9 |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 829efcccfa8f69db5dc8332961295587d218cee6 | 829efcccfa8f69db5dc8332961295587d218cee6 |
| linux | linux | >= db75373c91b0cfb6a68ad6ae88721e4e21ae6261 < 1633111d69053512d099658d4a05fc736fab36b0 | 1633111d69053512d099658d4a05fc736fab36b0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.17 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.13 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.19 < 6.19.9 | 6.19.9 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.78 | 6.12.78 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
vendor_redhat·2026-05-08·CVSS 7.0
CVE-2026-43466 [MEDIUM] CWE-821 kernel: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
kernel: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
A flaw was found in the Linux kernel's mlx5e network driver. During a transmit (TX) error recovery process, a desynchronization occurs in the Direct Memory Access (DMA) First-In, First-Out (FIFO) buffer. This desynchronization causes the system to incorrectly unmap memory addresses, which can lead to memory corruption. This issue could result in a system crash, causing a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise L
GHSA
GHSA-757p-mh2f-rf8w: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQ
ghsa_unreviewed·2026-05-08
CVE-2026-43466 GHSA-757p-mh2f-rf8w: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQ
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,
desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old
dma_fifo_pc, while the consumer reads from position 0.
This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart.
At the point of reset, all WQEs have been flushed so dma_fifo_cc is
already equal to dma_fifo_pc. There is no need to reset either counter,
similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the foll
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58fhttps://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4ehttps://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8https://git.kernel.org/stable/c/ce1b19dd0684eeb68a124c11085bd611260b36d9
2026-05-08
Published