Executive brief
A vulnerability in the Linux kernel's Mellanox network driver could allow a remote attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system processes specific types of high-speed network traffic using XDP (Express Data Path) technology. This can lead to memory management errors that destabilize the operating system, impacting service availability and security.
Technical details
A vulnerability exists in the mlx5e driver's handling of XDP multi-buf fragments when using Striding RQ. When an XDP program modifies the buffer layout (e.g., via bpf_xdp_pull_data() or bpf_xdp_adjust_tail()) and drops fragments, the driver fails to correctly account for these fragments in its internal page reference counters. This leads to a negative reference counting error and a kernel panic (splat). The issue affects XDP_TX, XDP_REDIRECT, and XDP_PASS actions. A remote attacker could trigger this by sending specially crafted network packets that cause the XDP program to adjust the buffer tail or pull data, leading to memory corruption or denial of service. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.6.115 to 6.7, 6.12.56 to 6.13, 6.17.6 to 6.18, 6.18.1 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-03-05: patched: Initial patch authored by Dragos Tatulea
- 2026-05-08: disclosed: CVE published