CVE-2026-43012 Overview
CVE-2026-43012 is a Linux kernel vulnerability in the Mellanox mlx5 Ethernet driver. The flaw resides in the switchdev-to-legacy mode rollback path within net/mlx5. When switchdev mode initialization fails for an internal reason, the driver rolls back to legacy mode but incorrectly unregisters the uplink netdev. A subsequent attempt to unregister the same device triggers a kernel BUG at net/core/dev.c:12070, leading to a kernel panic.
The issue affects systems running ConnectX adapters with the mlx5_core driver and is triggered through devlink operations that switch the e-switch mode.
Critical Impact
Local users with CAP_NET_ADMIN privileges can trigger a kernel panic by issuing a devlink command that causes a switchdev mode failure, resulting in denial of service on the host.
Affected Products
- Linux kernel versions containing the mlx5_core switchdev rollback logic prior to the patched commits
- Systems using Mellanox ConnectX adapters with the mlx5 driver
- Distributions shipping pre-patch kernels that expose devlink e-switch mode configuration
Discovery Timeline
- 2026-05-01 - CVE-2026-43012 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-43012
Vulnerability Analysis
The defect lies in the e-switch mode transition logic in the mlx5_core driver. When the user requests switchdev mode through devlink, the driver invokes mlx5_devlink_eswitch_mode_set which calls mlx5_eswitch_enable_locked and ultimately esw_offloads_enable. If any internal step fails, such as a QUERY_HCA_CAP command returning bad parameter status, the driver rolls back to legacy mode.
The rollback path calls mlx5e_vport_rep_unload, which in turn invokes unregister_netdev on the uplink representor. The netdev was never re-registered as a non-representor device, leaving the kernel networking core in an inconsistent state. The next call to unregister_netdevice_many_notify hits the BUG_ON assertion at net/core/dev.c:12070, panicking the kernel.
The call trace reproduced in the commit message shows the failure originating from devlink_nl_eswitch_set_doit invoked through the netlink generic family handler.
Root Cause
The rollback handler did not flag the e-switch as transitioning back to legacy mode. Without the MLX5_PRIV_FLAGS_SWITCH_LEGACY indicator set, the unload path treated the uplink representor as a fully managed netdev and unregistered it. The patch sets the rollback flag so the unload routine skips the netdev unregistration step.
Attack Vector
Exploitation requires local access with the CAP_NET_ADMIN capability to send devlink netlink messages. An administrator or container with elevated network privileges can issue an e-switch mode change against an mlx5 device under conditions that cause the firmware command to fail. The resulting kernel BUG halts the system, producing a denial of service. There is no indication of memory corruption or code execution potential.
No public exploit is available, and the EPSS probability is 0.023%.
Detection Methods for CVE-2026-43012
Indicators of Compromise
- Kernel log entries containing kernel BUG at net/core/dev.c:12070 accompanied by unregister_netdevice_many_notify in the call trace
- mlx5_core log messages reporting QUERY_HCA_CAP(0x100) failures with status bad parameter and Unloading uplink representor for vport 65535
- Unexpected host reboots correlated with devlink dev eswitch set operations on Mellanox interfaces
Detection Strategies
- Monitor dmesg and /var/log/kern.log for the specific BUG signature and mlx5_core E-Switch transition errors
- Audit devlink netlink activity through auditd rules on sendto and sendmsg syscalls targeting the generic netlink family
- Track installed kernel package versions across the fleet and flag hosts running unpatched mlx5_core modules
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized logging or SIEM platform and alert on unregister_netdevice BUG patterns
- Correlate kernel panics with prior devlink command execution by privileged users or orchestration agents
- Review SR-IOV and switchdev configuration changes during change-management windows to detect unauthorized e-switch mode toggles
How to Mitigate CVE-2026-43012
Immediate Actions Required
- Apply the upstream Linux kernel patches that set the MLX5_PRIV_FLAGS_SWITCH_LEGACY flag during switchdev rollback
- Update to a distribution kernel that includes the fixes referenced in the kernel.org commits below
- Restrict CAP_NET_ADMIN and devlink access to trusted administrators only
Patch Information
The fix is committed upstream across multiple stable branches. Refer to the following kernel.org commits: Kernel commit 2ebb13f3e8be, Kernel commit 403186400a1a, Kernel commit 4363698838b7, and Kernel commit e27153b2bd6e. Rebuild and deploy the patched kernel, then reboot affected hosts to load the fixed mlx5_core module.
Workarounds
- Avoid changing e-switch mode on production mlx5 devices until the patched kernel is deployed
- Remove or restrict CAP_NET_ADMIN from container workloads and unprivileged services that do not require network configuration rights
- Use SELinux or AppArmor policies to deny devlink netlink operations to unauthorized processes
# Configuration example: verify mlx5 module version and current eswitch mode
modinfo mlx5_core | grep -E '^(version|srcversion):'
devlink dev eswitch show pci/0000:00:03.0
# Restrict CAP_NET_ADMIN in systemd units that do not need it
# Add to the [Service] section of the unit file:
# CapabilityBoundingSet=~CAP_NET_ADMIN
# AmbientCapabilities=
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
