Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en): Every time an XDP_TX transmit fails because the XDP send

CVSS 7.5CVE-2026-53229Firmware, BMC & network fabriccurated

Impact

Every time an XDP_TX transmit fails because the XDP send queue is full, the driver leaks both the frame and its DMA mapping. Under sustained load that is thousands of device-writable IOMMU mappings left standing for buffers the kernel no longer tracks, plus unbounded memory growth - the node runs out of memory and the stale mappings remain addressable by the NIC.

Who can reach it

A peer on the fabric drives it directly: flood the node hard enough that the XDP transmit queue backs up and every dropped XDP_TX frame leaks. Conditional on AF_XDP zero-copy being in use with an XDP program that returns XDP_TX on an mlx5 interface. No tenant device node required - the leak is in host memory shared by all tenants on the node.

What to do

Update to a kernel carrying the fix on your stream. Interim: stop using AF_XDP zero-copy with XDP_TX on mlx5 interfaces, or rate-limit untrusted ingress so the XDP send queue does not saturate.

References

https://git.kernel.org/stable/c/7b3eeba50fbc3b45f279037c29a87a90e8bac1e1 https://git.kernel.org/stable/c/2789b74ae1f4b68333c9d5eec2f3354d07b16e61 https://nvd.nist.gov/vuln/detail/CVE-2026-53229

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.