CVE-2026-74698: net/mlx5e: fix BQL reset on SQ re-activation
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: fix BQL reset on SQ re-activation
mlx5equeuestart() deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq() then unconditionally calls netdevtxresetqueue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUGON() in dqlcompleted():
kernel BUG at lib/dynamicqueuelimits.c:99! RIP: 0010:dqlcompleted+0x23d/0x280 Call Trace: <IRQ> mlx5epolltxcq+0x668/0xa60 mlx5enapipoll+0x5b/0x7b0 netrxaction+0x15a/0x580
Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).
In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mlx5e SQ re-activation logic, reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc), and preserve dql->limit across the reset.
Event History
Frequently Asked Questions
Which systems are exposed to this failure?
Systems running the Linux kernel with the mlx5e network driver are exposed when an SQ is reactivated while it still has transmit work queue elements in flight. The described failure occurs when later TX completion processing over-charges BQL and triggers the dql_completed() BUG_ON().
What condition triggers the kernel BUG?
The issue requires queue restart handling that deactivates and reactivates channels while only closing the queue being restarted. If netdev_tx_reset_queue() resets BQL counters for an SQ whose sq->cc and sq->pc indicate outstanding work, a subsequent completion can trigger the BUG.
What is the mitigation if the fix cannot be applied immediately?
The provided data does not identify a configuration workaround. The fix avoids resetting BQL for an SQ with bytes in flight, allowing outstanding WQEs to complete and rebalance DQL instead.