Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When an XDP program shrinks a multi-fragment receive buffer

CVSS 7.5CVE-2026-43464Firmware, BMC & network fabriccurated

Impact

When an XDP program shrinks a multi-fragment receive buffer, the driver loses track of the fragments the XDP core already released, so the page-pool reference count on those pages goes negative. A negative refcount means pages are handed back to the allocator while the receive ring still owns them - page-pool accounting corruption on the RX path that ends in reuse of live DMA pages and node instability.

Who can reach it

Driven from the wire: a fabric peer sends frames large enough to span multiple receive fragments (jumbo / scattered payloads), and any XDP program on the interface that calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail() triggers the miscount. Conditional on legacy (non-striding) RQ plus an attached XDP multi-buffer program - common on nodes running an XDP-based dataplane or eBPF firewall in front of tenants.

What to do

Update to 6.7.x / 6.13.x / 6.18 or later per your stream. Interim: detach XDP multi-buffer programs from mlx5 interfaces, or switch the interfaces to striding RQ so the legacy-RQ fragment path is not used.

References

https://git.kernel.org/stable/c/c74557495efb4bd0adefdfc8678ecdbc82a06da3 https://git.kernel.org/stable/c/03cb50e5b74fce8bf6d92b860371b66253cf0f8d https://nvd.nist.gov/vuln/detail/CVE-2026-43464

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.