CVE-2026-43464

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ

XDP multi-buf programs can modify the layout of the XDP buffer when the

program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The

referenced commit in the fixes tag corrected the assumption in the mlx5

driver that the XDP buffer layout doesn't change during a program

execution. However, this fix introduced another issue: the dropped

fragments still need to be counted on the driver side to avoid page

fragment reference counting issues.

Such issue can be observed with the

test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of

3600 and shrinking by 256 bytes (an upcoming selftest patch): the last

fragment gets released by the XDP code but doesn't get tracked by the

driver. This results in a negative pp_ref_count during page release and

the following splat:

WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.i

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References