Executive brief
A vulnerability in the Linux kernel's Mellanox (mlx5) network driver could allow a remote attacker to cause a system crash or instability. The issue occurs during network error recovery, where the system incorrectly manages memory addresses used for high-speed data transfers. This can lead to a 'denial of service' where the affected server becomes unresponsive or reboots unexpectedly.
Technical details
A synchronization issue exists in the net/mlx5e component of the Linux kernel during Send Queue (SQ) recovery from an error Completion Queue Entry (CQE). The function mlx5e_reset_txqsq_cc_pc() incorrectly resets the DMA FIFO consumer counter (dma_fifo_cc) to zero without resetting the producer counter (dma_fifo_pc). This desynchronization causes the driver to unmap stale DMA addresses from before the recovery when new traffic is processed. An attacker can trigger this condition via network traffic that induces TX errors, leading to kernel warnings (e.g., in iommu_dma_unmap_page) and potential system instability or a kernel panic. The fix involves removing the unnecessary counter reset during the recovery flow.
Affected products
- Linux Linux Kernel 4.17 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-05: patched: Initial patch authored by Gal Pressman
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0
- https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58f
- https://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23
- https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e
- https://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544
- https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6
- https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8