Is CVE-2026-43465 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43465 being exploited in the wild.

How severe is CVE-2026-43465?

Critical severity, with a CVSS score of 9.8, published 8 May 2026.

Which products and versions are affected?

Linux Kernel 6.18.0-rc7 and earlier versions.

Is there a fix for CVE-2026-43465?

A patch was published on 2026-03-05: Initial patch authored by Dragos Tatulea Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43465 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-43465?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43465: Linux Kernel mlx5e reference counting error in XDP multi-buf RX

CVE-2026-43465 · Severity: critical · CVSS 9.8 · Published 2026-05-08

A vulnerability in the Linux kernel's Mellanox network driver could allow a remote attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system processes specific types of high-speed network traffic using XDP (Express Data Path) technology. This can lead to memory management errors that destabilize the operating system, impacting service availability and security.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-43465 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43465 being exploited in the wild.
How severe is CVE-2026-43465?: Critical severity, with a CVSS score of 9.8, published 8 May 2026.
Which products and versions are affected?: Linux Kernel 6.18.0-rc7 and earlier versions.
Is there a fix for CVE-2026-43465?: A patch was published on 2026-03-05: Initial patch authored by Dragos Tatulea Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43465 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-43465?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the mlx5e driver's handling of XDP multi-buf fragments when using Striding RQ. When an XDP program modifies the buffer layout (e.g., via bpf_xdp_pull_data() or bpf_xdp_adjust_tail()) and drops fragments, the driver fails to correctly account for these fragments in its internal page reference counters. This leads to a negative reference counting error and a kernel panic (splat). The issue affects XDP_TX, XDP_REDIRECT, and XDP_PASS actions. A remote attacker could trigger this by sending specially crafted network packets that cause the XDP program to adjust the buffer tail or pull data, leading to memory corruption or denial of service. Patches have been released for various stable kernel branches.

Affected products

Linux Linux Kernel 6.6.115 to 6.7, 6.12.56 to 6.13, 6.17.6 to 6.18, 6.18.1 to 6.18.19, 6.19 to 6.19.9

Timeline

2026-03-05: patched: Initial patch authored by Dragos Tatulea
2026-05-08: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.