CVE-2026-43465
Buffer Fragment Reference Counting Flaw in Mellanox mlx5e Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mlx | mlx5_core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mlx5 driver related to XDP (eXpress Data Path) multi-buffer fragment counting. When an XDP multi-buf program modifies the layout of the XDP buffer using functions like bpf_xdp_pull_data() or bpf_xdp_adjust_tail(), the mlx5 driver incorrectly assumes the buffer layout does not change during execution.
This incorrect assumption leads to the driver failing to count dropped fragments properly, causing a mismatch in page fragment reference counting. Specifically, the driver releases more fragments than it should, resulting in negative reference counting errors and kernel warnings or crashes.
The issue was discovered through a self-test that showed the mlx5 driver releasing fragments incorrectly after an XDP program drops a tail fragment. The fix involves correctly counting all original XDP buffer fragments for all relevant XDP actions (XDP_TX, XDP_REDIRECT, and XDP_PASS), reverting to the original counting method before the problematic commit.
How can this vulnerability impact me? :
This vulnerability can cause negative reference counting errors in the mlx5 driver, which may lead to kernel warnings, instability, or crashes during network packet processing.
Such instability can affect the reliability and availability of systems using the mlx5 network driver, potentially causing network disruptions or degraded performance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability was discovered by the drivers/net/xdp.py selftest, specifically the test_xdp_native_tx_mb test. Detection involves observing kernel warnings related to mlx5e_page_release_fragmented and negative reference counting errors in the mlx5 driver.
You can monitor your system logs for warnings similar to the following message indicating the issue: "WARNING: CPU: ... mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]".
To detect this vulnerability, you may run the mlx5 driver selftests if available, or monitor kernel logs (e.g., using dmesg or journalctl) for related error messages.
- Check kernel logs for mlx5 driver warnings: sudo dmesg | grep mlx5e_page_release_fragmented
- Run the mlx5 driver selftest if available: python3 drivers/net/xdp.py test_xdp_native_tx_mb
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by a patch that correctly counts page fragments for all relevant XDP actions in the mlx5 driver. Immediate mitigation involves updating the Linux kernel to a version that includes this fix.
Until the patch is applied, avoid running XDP multi-buf programs that call bpf_xdp_pull_data() or bpf_xdp_adjust_tail() on systems using the mlx5 driver, as these trigger the issue.
Monitoring for the described kernel warnings can help identify if the issue is occurring, but the primary mitigation is to apply the kernel update containing the fix.