CVE-2026-74698: net/mlx5e: fix BQL reset on SQ re-activation

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix BQL reset on SQ re-activation

mlx5equeuestart() deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq() then unconditionally calls netdevtxresetqueue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUGON() in dqlcompleted():

kernel BUG at lib/dynamicqueuelimits.c:99! RIP: 0010:dqlcompleted+0x23d/0x280 Call Trace: <IRQ> mlx5epolltxcq+0x668/0xa60 mlx5enapipoll+0x5b/0x7b0 netrxaction+0x15a/0x580

Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).

In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.

Affected Software

1 affected component

Linux Linux kernel

Event History

Aug 22, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Which systems are exposed to this failure?

Systems running the Linux kernel with the mlx5e network driver are exposed when an SQ is reactivated while it still has transmit work queue elements in flight. The described failure occurs when later TX completion processing over-charges BQL and triggers the dql_completed() BUG_ON().

What condition triggers the kernel BUG?

The issue requires queue restart handling that deactivates and reactivates channels while only closing the queue being restarted. If netdev_tx_reset_queue() resets BQL counters for an SQ whose sq->cc and sq->pc indicate outstanding work, a subsequent completion can trigger the BUG.

What is the mitigation if the fix cannot be applied immediately?

The provided data does not identify a configuration workaround. The fix avoids resetting BQL for an SQ with bytes in flight, allowing outstanding WQEs to complete and rebalance DQL instead.

CVE-2026-74698: net/mlx5e: fix BQL reset on SQ re-activation

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this failure?

What condition triggers the kernel BUG?

What is the mitigation if the fix cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this failure?

What condition triggers the kernel BUG?

What is the mitigation if the fix cannot be applied immediately?