{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-43466",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-43466"
  ],
  "published": "2026-05-08T14:22:57Z",
  "summary": "net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\n\nIn case of a TX error CQE, a recovery flow is triggered,\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\ndesyncing the DMA FIFO producer and consumer.\n\nAfter recovery, the producer pushes new DMA entries at the old\ndma_fifo_pc, while the consumer reads from position 0.\nThis causes us to unmap stale DMA addresses from before the recovery.\n\nThe DMA FIFO is a purely software construct with no HW counterpart.\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\nalready equal to dma_fifo_pc. There is no need to reset either counter,\nsimilar to how skb_fifo pc/cc are untouched.\n\nRemove the 'dma_fifo_cc = 0' reset.\n\nThis fixes the following WARNING:\n    WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\n    Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n    RIP: 0010:iommu_dma_unmap_page+0x79/0x90\n    Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\n    Call Trace:\n     <IRQ>\n     ? __warn+0x7d/0x110\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? report_bug+0x16d/0x180\n     ? handle_bug+0x4f/0x90\n     ? exc_invalid_op+0x14/0x70\n     ? asm_exc_invalid_op+0x16/0x20\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? iommu_dma_unmap_page+0x2e/0x90\n     dma_unmap_page_attrs+0x10d/0x1b0\n     mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\n     mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\n     mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\n     __napi_poll+0x24/0x190\n     net_rx_action+0x32a/0x3b0\n     ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\n     ? notifier_call_chain+0x35/0xa0\n     handle_softirqs+0xc9/0x270\n     irq_exit_rcu+0x71/0xd0\n     common_interrupt+0x7f/0xa0\n     </IRQ>\n     <TASK>\n     asm_common_interrupt+0x22/0x40",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.167",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43466"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ce1b19dd0684eeb68a124c11085bd611260b36d9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.2,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - In a severe reasonable deployment, mlx5e backs network-facing servers, routers, or cloud forwarding paths where remote packets cause kernel TX through `dev_queue_xmit` and `mlx5e_xmit`; no local device file or ioctl is needed to reach the affected transmit/recovery path.\nAC:L - Once a TX error CQE occurs, the recovery desynchronizes the software DMA FIFO deterministically and later TX completions consume stale FIFO entries. There is no attacker-uncontrolled race in the vulnerable logic, so the higher-severity low complexity value is appropriate.\nPR:N - The reachable data path has no credential or capability check, and a remote peer can make the host transmit packets through exposed services or forwarding workloads. The recovery is automatic through the devlink health reporter rather than gated by an admin action.\nUI:N - No victim user action is required after the affected mlx5e interface is active; packet transmission, CQ polling, and recovery occur asynchronously in kernel/NAPI/workqueue context.\nS:U - The bug affects the host kernel driver's own DMA bookkeeping and availability within the same security authority. It does not create a demonstrated VM escape or IOMMU/DMA boundary bypass that would justify changed scope.\nC:N - The investigated failure is stale DMA unmapping, not an out-of-bounds read or CPU memory disclosure primitive. I found no evidence that it exposes kernel memory contents to the attacker.\nI:L - Stale DMA unmaps can release or disturb the wrong DMA/IOMMU mappings and corrupt device I/O state for packets, but the code path does not provide an arbitrary write or control-flow primitive. Choosing low integrity impact reflects the higher-severity side of the plausible non-arbitrary data corruption assessment.\nA:H - The observed failure is a WARN in `iommu_dma_unmap_page` from IRQ/NAPI context, and systems with `panic_on_warn` or repeated DMA/IOMMU faults can suffer a kernel panic or persistent network outage. This is a high availability impact."
    }
  }
}