GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43466 (GCVE-0-2026-43466)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:22 – Updated: 2026-08-05 12:28
VLAI
Title
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer. After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery. The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dma_fifo_cc is already equal to dma_fifo_pc. There is no need to reset either counter, similar to how skb_fifo pc/cc are untouched. Remove the 'dma_fifo_cc = 0' reset. This fixes the following WARNING: WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90 Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00 Call Trace: <IRQ> ? __warn+0x7d/0x110 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0x16d/0x180 ? handle_bug+0x4f/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 ? iommu_dma_unmap_page+0x2e/0x90 dma_unmap_page_attrs+0x10d/0x1b0 mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core] mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core] mlx5e_napi_poll+0x8b/0xac0 [mlx5_core] __napi_poll+0x24/0x190 net_rx_action+0x32a/0x3b0 ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core] ? notifier_call_chain+0x35/0xa0 handle_softirqs+0xc9/0x270 irq_exit_rcu+0x71/0xd0 common_interrupt+0x7f/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 821f85d619f7f22cda7b9d7de89cf5eeb1d11544 (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 6eb68ecc5acc3b319986566c595990b8a7265b23 (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 383b37c04a4827ba60b2bafc1a6cdfd995aed58f (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8 (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < ce1b19dd0684eeb68a124c11085bd611260b36d9 (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 829efcccfa8f69db5dc8332961295587d218cee6 (git)
Affected: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 , < 1633111d69053512d099658d4a05fc736fab36b0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "821f85d619f7f22cda7b9d7de89cf5eeb1d11544",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "6eb68ecc5acc3b319986566c595990b8a7265b23",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "383b37c04a4827ba60b2bafc1a6cdfd995aed58f",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "ce1b19dd0684eeb68a124c11085bd611260b36d9",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "829efcccfa8f69db5dc8332961295587d218cee6",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            },
            {
              "lessThan": "1633111d69053512d099658d4a05fc736fab36b0",
              "status": "affected",
              "version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\n\nIn case of a TX error CQE, a recovery flow is triggered,\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\ndesyncing the DMA FIFO producer and consumer.\n\nAfter recovery, the producer pushes new DMA entries at the old\ndma_fifo_pc, while the consumer reads from position 0.\nThis causes us to unmap stale DMA addresses from before the recovery.\n\nThe DMA FIFO is a purely software construct with no HW counterpart.\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\nalready equal to dma_fifo_pc. There is no need to reset either counter,\nsimilar to how skb_fifo pc/cc are untouched.\n\nRemove the \u0027dma_fifo_cc = 0\u0027 reset.\n\nThis fixes the following WARNING:\n    WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\n    Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n    RIP: 0010:iommu_dma_unmap_page+0x79/0x90\n    Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff \u003c0f\u003e 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\n    Call Trace:\n     \u003cIRQ\u003e\n     ? __warn+0x7d/0x110\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? report_bug+0x16d/0x180\n     ? handle_bug+0x4f/0x90\n     ? exc_invalid_op+0x14/0x70\n     ? asm_exc_invalid_op+0x16/0x20\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? iommu_dma_unmap_page+0x2e/0x90\n     dma_unmap_page_attrs+0x10d/0x1b0\n     mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\n     mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\n     mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\n     __napi_poll+0x24/0x190\n     net_rx_action+0x32a/0x3b0\n     ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\n     ? notifier_call_chain+0x35/0xa0\n     handle_softirqs+0xc9/0x270\n     irq_exit_rcu+0x71/0xd0\n     common_interrupt+0x7f/0xa0\n     \u003c/IRQ\u003e\n     \u003cTASK\u003e\n     asm_common_interrupt+0x22/0x40"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In a severe reasonable deployment, mlx5e backs network-facing servers, routers, or cloud forwarding paths where remote packets cause kernel TX through `dev_queue_xmit` and `mlx5e_xmit`; no local device file or ioctl is needed to reach the affected transmit/recovery path.\nAC:L - Once a TX error CQE occurs, the recovery desynchronizes the software DMA FIFO deterministically and later TX completions consume stale FIFO entries. There is no attacker-uncontrolled race in the vulnerable logic, so the higher-severity low complexity value is appropriate.\nPR:N - The reachable data path has no credential or capability check, and a remote peer can make the host transmit packets through exposed services or forwarding workloads. The recovery is automatic through the devlink health reporter rather than gated by an admin action.\nUI:N - No victim user action is required after the affected mlx5e interface is active; packet transmission, CQ polling, and recovery occur asynchronously in kernel/NAPI/workqueue context.\nS:U - The bug affects the host kernel driver\u0027s own DMA bookkeeping and availability within the same security authority. It does not create a demonstrated VM escape or IOMMU/DMA boundary bypass that would justify changed scope.\nC:N - The investigated failure is stale DMA unmapping, not an out-of-bounds read or CPU memory disclosure primitive. I found no evidence that it exposes kernel memory contents to the attacker.\nI:L - Stale DMA unmaps can release or disturb the wrong DMA/IOMMU mappings and corrupt device I/O state for packets, but the code path does not provide an arbitrary write or control-flow primitive. Choosing low integrity impact reflects the higher-severity side of the plausible non-arbitrary data corruption assessment.\nA:H - The observed failure is a WARN in `iommu_dma_unmap_page` from IRQ/NAPI context, and systems with `panic_on_warn` or repeated DMA/IOMMU faults can suffer a kernel panic or persistent network outage. This is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:09.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce1b19dd0684eeb68a124c11085bd611260b36d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0"
        }
      ],
      "title": "net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43466",
    "datePublished": "2026-05-08T14:22:27.513Z",
    "dateReserved": "2026-05-01T14:12:56.011Z",
    "dateUpdated": "2026-08-05T12:28:09.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43466",
      "date": "2026-09-16",
      "epss": "0.00329",
      "percentile": "0.26029"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43466\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:59.543\",\"lastModified\":\"2026-06-17T10:49:39.300\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\\n\\nIn case of a TX error CQE, a recovery flow is triggered,\\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\\ndesyncing the DMA FIFO producer and consumer.\\n\\nAfter recovery, the producer pushes new DMA entries at the old\\ndma_fifo_pc, while the consumer reads from position 0.\\nThis causes us to unmap stale DMA addresses from before the recovery.\\n\\nThe DMA FIFO is a purely software construct with no HW counterpart.\\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\\nalready equal to dma_fifo_pc. There is no need to reset either counter,\\nsimilar to how skb_fifo pc/cc are untouched.\\n\\nRemove the \u0027dma_fifo_cc = 0\u0027 reset.\\n\\nThis fixes the following WARNING:\\n    WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\\n    Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n    RIP: 0010:iommu_dma_unmap_page+0x79/0x90\\n    Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff \u003c0f\u003e 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\\n    Call Trace:\\n     \u003cIRQ\u003e\\n     ? __warn+0x7d/0x110\\n     ? iommu_dma_unmap_page+0x79/0x90\\n     ? report_bug+0x16d/0x180\\n     ? handle_bug+0x4f/0x90\\n     ? exc_invalid_op+0x14/0x70\\n     ? asm_exc_invalid_op+0x16/0x20\\n     ? iommu_dma_unmap_page+0x79/0x90\\n     ? iommu_dma_unmap_page+0x2e/0x90\\n     dma_unmap_page_attrs+0x10d/0x1b0\\n     mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\\n     mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\\n     mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\\n     __napi_poll+0x24/0x190\\n     net_rx_action+0x32a/0x3b0\\n     ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\\n     ? notifier_call_chain+0x35/0xa0\\n     handle_softirqs+0xc9/0x270\\n     irq_exit_rcu+0x71/0xd0\\n     common_interrupt+0x7f/0xa0\\n     \u003c/IRQ\u003e\\n     \u003cTASK\u003e\\n     asm_common_interrupt+0x22/0x40\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"821f85d619f7f22cda7b9d7de89cf5eeb1d11544\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"6eb68ecc5acc3b319986566c595990b8a7265b23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"383b37c04a4827ba60b2bafc1a6cdfd995aed58f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"ce1b19dd0684eeb68a124c11085bd611260b36d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"829efcccfa8f69db5dc8332961295587d218cee6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db75373c91b0cfb6a68ad6ae88721e4e21ae6261\",\"lessThan\":\"1633111d69053512d099658d4a05fc736fab36b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"DEE6D861-833E-4A69-98AC-2743228E5BAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce1b19dd0684eeb68a124c11085bd611260b36d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:47:27+00:00",
      "cve": "CVE-2026-43466",
      "id": "CVE-2026-43466",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43466.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:17:17Z",
      "cve": "CVE-2026-43466",
      "id": "CVE-2026-43466",
      "initial_release_date": "2026-05-12T03:29:47Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "615",
      "product_status:known_not_affected": "34",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43466",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43466.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.