CVE-2026-43464
Buffer Fragment Counting Issue in Linux Kernel's mlx5e Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mlx | mlx5_core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mlx5 driver related to XDP (eXpress Data Path) multi-buffer programs. These programs can modify the layout of the XDP buffer during execution using functions like bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The mlx5 driver incorrectly assumed that the buffer layout would not change during execution.
A fix was introduced to correct this assumption, but it caused another problem: the driver failed to properly count dropped fragments of the buffer. This improper counting leads to negative reference counts during page release, which can cause kernel warnings and potential instability.
The issue manifests as a warning and a kernel 'splat' (crash) related to page fragment reference counting, triggered under specific test conditions involving shrinking payload data in XDP multi-buffer programs.
The patch to fix this vulnerability restores proper fragment counting for all original XDP buffer fragments across relevant XDP actions (XDP_TX, XDP_REDIRECT, and XDP_PASS), ensuring stable and correct memory management in the driver.
How can this vulnerability impact me? :
This vulnerability can cause kernel instability or crashes due to incorrect reference counting of memory fragments in the mlx5 driver when using XDP multi-buffer programs.
Such instability may lead to unexpected system warnings, degraded network performance, or potential denial of service conditions on systems using the affected mlx5 driver with XDP features.
Systems relying on high-performance networking with mlx5 hardware and XDP multi-buffer programs are particularly at risk of encountering these issues.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel warnings related to mlx5_core, specifically messages indicating negative page fragment reference counts during page release. For example, kernel logs may show warnings like:
- WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]
- CPU#12: ip/3137
To detect this on your system, you can monitor kernel logs using commands such as:
- dmesg | grep mlx5_core
- journalctl -k | grep mlx5_core
Additionally, running the selftest test_xdp_native_adjst_tail_shrnk_data with a payload of 3600 and shrinking by 256 bytes can reproduce the issue if the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by a patch that correctly counts page fragments on all original XDP buffer fragments for relevant XDP actions (XDP_TX, XDP_REDIRECT, and XDP_PASS).
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid running XDP multi-buf programs that call bpf_xdp_pull_data() or bpf_xdp_adjust_tail() on affected mlx5 drivers until the patch is applied.
- Monitor kernel logs for warnings related to mlx5_core and page fragment reference counts to detect potential exploitation.