CVE-2026-43465

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ

XDP multi-buf programs can modify the layout of the XDP buffer when the

program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The

referenced commit in the fixes tag corrected the assumption in the mlx5

driver that the XDP buffer layout doesn't change during a program

execution. However, this fix introduced another issue: the dropped

fragments still need to be counted on the driver side to avoid page

fragment reference counting issues.

The issue was discovered by the drivers/net/xdp.py selftest,

more specifically the test_xdp_native_tx_mb:

- The mlx5 driver allocates a page_pool page and initializes it with

a frag counter of 64 (pp_ref_count=64) and the internal frag counter

to 0.

- The test sends one packet with no payload.

- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP

buffer with the packet data starting in the firs

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References