CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQE, a recovery flow is triggered, mlx5eresettxqsqccpc() resets dmafifocc to 0 but not dmafifopc, desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old dmafifopc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dmafifocc is already equal to dmafifopc. There is no need to reset either counter, similar to how skbfifo pc/cc are untouched.
Remove the 'dmafifocc = 0' reset.
This fixes the following WARNING: WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommudmaunmappage+0x79/0x90 Modules linked in: mlx5vdpa vringh vdpa bonding mlx5ib mlx5vfiopci ipip mlx5fwctl tunnel4 mlx5core ibipoib geneve ip6gre ipgre gre nftables ip6tunnel rdmaucm ibuverbs ibumad vfiopci vfiopcicore actmirred actskbedit actvlan vhostnet vhost tap ip6tablemangle ip6tablenat ip6tablefilter ip6tables iptablemangle clsmatchall nfnetlinkcttimeout actgact clsflower schingress vhostiotlb iptableraw tunnel6 vfioiommutype1 vfio openvswitch nsh rpcsecgsskrb5 authrpcgss oidregistry xtconntrack xtMASQUERADE nfconntracknetlink nfnetlink iptablenat nfnat xtaddrtype brnetfilter overlay zram zsmalloc rpcrdma ibiser libiscsi scsitransportiscsi rdmacm iwcm ibcm ibcore fuse [last unloaded: nftables] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5forupstreammindebug202412302133 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommudmaunmappage+0x79/0x90 Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00 Call Trace: <IRQ> ? warn+0x7d/0x110 ? iommudmaunmappage+0x79/0x90 ? reportbug+0x16d/0x180 ? handlebug+0x4f/0x90 ? excinvalidop+0x14/0x70 ? asmexcinvalidop+0x16/0x20 ? iommudmaunmappage+0x79/0x90 ? iommudmaunmappage+0x2e/0x90 dmaunmappageattrs+0x10d/0x1b0 mlx5etxwidmaunmap+0xbe/0x120 [mlx5core] mlx5epolltxcq+0x16d/0x690 [mlx5core] mlx5enapipoll+0x8b/0xac0 [mlx5core] napipoll+0x24/0x190 netrxaction+0x32a/0x3b0 ? mlx5eqcompint+0x7e/0x270 [mlx5core] ? notifiercallchain+0x35/0xa0 handlesoftirqs+0xc9/0x270 irqexitrcu+0x71/0xd0 commoninterrupt+0x7f/0xa0 </IRQ> <TASK> asmcommoninterrupt+0x22/0x40
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove/stop the reset that sets dma_fifo_cc = 0 during mlx5e_reset_txqsq_cc_pc() so that the DMA FIFO producer/consumer positions are not desynchronized and stale DMA addresses from before recovery are not unmapped.
Linux kernel (drivers/iommu/dma-iommu.c / net/mlx5e) dma_fifo_cc reset on mlx5e SQ/CC recovery = do not reset to 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43466?
CVE-2026-43466 is classified as a medium severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2026-43466?
To fix CVE-2026-43466, update the Linux kernel to the latest version where this vulnerability has been resolved.
Which Linux kernel versions are affected by CVE-2026-43466?
CVE-2026-43466 affects the mlx5e driver in the Linux kernel, specifically prior versions that do not include the fix.
Can CVE-2026-43466 lead to data loss?
Yes, CVE-2026-43466 has the potential to cause data loss due to DMA FIFO desynchronization during transmission errors.
Is CVE-2026-43466 related to network performance?
Yes, CVE-2026-43466 can degrade network performance by causing issues during the error recovery process in the mlx5e driver.