Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350

CVE-2026-43465Kernel, userspace & hypervisornet/mlx5e RX XDP multi-buf frag counting for striding RQcurated

Impact

A regression introduced by the fix for CVE-2025-40350: dropped XDP fragments stopped being counted driver-side, so page_pool reference counts go negative and mlx5 releases 64 fragments against a refcount of 63. Remote packets corrupt page-pool refcounting in the host kernel. Worth flagging to operators as a pattern - patching the earlier RX bug without moving to a current stable re-exposes you.

Who can reach it

Unauthenticated remote sender to a node running XDP multi-buffer on mlx5 striding RQ, on a kernel that carries the CVE-2025-40350 fix but not this one.

What to do

Upgrade the host kernel to 7.0 or a stable backport (6.18.19, 6.19.9). Rolling reboot. Do not stop at the CVE-2025-40350 fix level - verify your running kernel carries both.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-43465 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43465.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.