Executive brief
A flaw in the Linux kernel's Mellanox mlx5e network driver causes a kernel panic when restarting send queues. The driver incorrectly resets byte queue limit (BQL) counters for all channels, even those with pending network packets still in flight, leading to accounting errors and a kernel crash. This disrupts system stability and availability on servers using affected Mellanox network hardware.
Technical details
The vulnerability is a logic error in the mlx5e_activate_txqsq() function in the net/mlx5e driver. The vulnerable code unconditionally calls netdev_tx_reset_queue() to reset BQL counters whenever a send queue is re-activated, even if the queue has in-flight transmit work queue entries (WQEs). When channels are restarted via mlx5e_queue_start(), channels that keep their WQEs will have zeroed BQL counters despite having outstanding bytes, causing the next TX completion to over-charge the dynamic queue limit (dql) counter and trigger a BUG_ON() panic in dql_completed(). The fix conditionally resets BQL only when sq->cc == sq->pc (no bytes in flight), allowing outstanding WQEs to naturally complete and rebalance the counter. The patch is available in upstream Linux and stable kernels.
Affected products
- Linux Linux Kernel Affects kernels with commit b2588ea40ec9 and later; fixed in upstream and stable branches via commit e7386770be1bf810bcd6af39d1e4bfeab3408430
Timeline
- 2026-08-22: disclosed: CVE published on NVD
- 2026-08-19: patched: Fix merged into stable and upstream Linux kernel trees via commit e7386770be1bf810bcd6af39d1e4bfeab3408430
- 2026-08-03: other: Patch authored by Bobby Eshleman (Meta)