CVE-2026-52983: net: airoha: fix BQL imbalance in TX path
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: fix BQL imbalance in TX path
Fix a possible BQL imbalance in airohadevxmit(), where inflight packets are accounted only for the AIROHANUMTXRING netdev TX queues. The queue index is computed as:
qid = skbgetqueuemapping(skb) % ARRAYSIZE(qdma->qtx) txq = netdevgettxqueue(dev, qid);
However, airohaqdmatxnapipoll() accounts completions across all netdev TX queues (numtxqueues), leading to inconsistent BQL accounting.
Also reset all netdev TX queues in the ndostop callback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the TX path so BQL accounting is consistent: completions in airoha_qdma_tx_napi_poll() must account across all netdev TX queues (num_tx_queues), while packet accounting uses the computed queue index qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx) and selects txq = netdev_get_tx_queue(dev, qid).
Linux kernel net: airoha TX path BQL accounting (netdev TX queues) = Account completions across all num_tx_queues instead of only AIROHA_NUM_TX_RING; compute qid as skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx) and use it to select txq via netdev_get_tx_queue(dev, qid) - Operational
Reset all netdev TX queues in the ndo_stop callback.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The provided severity vector indicates network reachability, low attack complexity, no required privileges, and no user interaction.
What is the expected security impact?
The severity vector indicates a high availability impact, with no stated confidentiality or integrity impact.
Which systems are most relevant for triage?
Prioritize Linux systems using the Airoha network driver and its TX path, where BQL accounting can become inconsistent across netdev TX queues.