CVE-2026-64210

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix unlocked writing to ICOSQ

During napi poll, when the affinity changes and there's still XSK work

to be done, we trigger an ICOSQ interrupt on the new CPU. However, this

triggering on the ICOSQ is done unprotected.

There are 2 such races:

A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is

running from a different CPU due to affinity change. This can happen

because IRQ triggering is done after napi_complete_done(). At this point

the NAPI can be scheduled on a different CPU. Like this:

CPU A (old affinity, NAPI tail) CPU B (new affinity, fresh NAPI)

------------------------------- --------------------------------

napi_complete_done() clears SCHED

mlx5e_cq_arm(...)

napi_schedule_prep() sets SCHED

mlx5e_napi_poll()

mlx5e_xsk_alloc_rx_mpwqe()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References