CVE-2026-43296: Linux Kernel NIX SQM/PSE DOS Vulnerability

CVE-2026-43296 Overview

CVE-2026-43296 is a high-severity vulnerability in the Linux kernel's octeontx2-af network driver. The flaw resides in the NIX Send Queue Manager (SQM) sticky mode handling, where multiple Send Queues (SQs) sharing a Send Meta-data Queue (SMQ) can stall when transmitting concurrently. The Packet Send Engine (PSE) may also deadlock when transitioning between sticky and non-sticky transmissions, and credit drops occur when condition clocks are gated. The issue is tracked under CWE-667: Improper Locking.

Critical Impact
Network-adjacent attackers can trigger transmit stalls and PSE deadlocks on affected Marvell OcteonTX2 platforms, degrading or halting network availability without authentication.

Affected Products

Linux Kernel (mainline) with the octeontx2-af driver enabled
Linux stable branches prior to the patched commits
Systems using Marvell OcteonTX2 administrative function (AF) networking hardware

Discovery Timeline

2026-05-08 - CVE-2026-43296 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43296

Vulnerability Analysis

The vulnerability affects the NIX (Network Interface eXchange) block on Marvell OcteonTX2 silicon, specifically the Send Queue Manager (SQM) and Packet Send Engine (PSE) subsystems. When the SQM operates in sticky mode, it retains queue ownership across transmissions to optimize scheduling. However, when multiple Send Queues share a single Send Meta-data Queue (SMQ) and transmit concurrently, the sticky behavior produces forward-progress stalls.

A second defect appears in the PSE state machine. Transitions between sticky and non-sticky transmission paths can deadlock the engine, halting packet processing entirely. A third defect causes credit drops when certain condition clocks are gated, leading to lost flow-control credits that the hardware cannot reclaim. Each defect maps to the locking and synchronization weakness category described by [CWE-667].

Root Cause

The root cause is hardware errata in the OcteonTX2 NIX block rather than a software memory-safety flaw. The SQM sticky-mode optimization, the sticky-to-non-sticky transition path in the PSE, and clock gating in the credit return path each violate forward-progress assumptions that the driver and firmware depend on.

Attack Vector

The attack vector is network-adjacent. An attacker who can place crafted traffic patterns onto an affected device, or who controls a workload that drives concurrent transmissions across multiple SQs sharing one SMQ, can induce the stall or deadlock. No authentication or user interaction is required, and successful exploitation results in loss of availability of the affected network interface.

Verified exploitation code is not publicly available. See the vendor commits referenced below for the full hardware workaround logic.

Detection Methods for CVE-2026-43296

Indicators of Compromise

Network interfaces backed by octeontx2-af reporting transmit queue stalls, watchdog timeouts, or TX hangs in dmesg
Sustained drops in SQM scheduler credits observable via driver debugfs counters
PSE state machine hangs reported by AF firmware logs around sticky/non-sticky transition events

Detection Strategies

Monitor kernel ring buffer for octeontx2-af driver errors, NIX SQ stall messages, and netdev watchdog events on affected platforms
Inspect the value of NIX_AF_SQM_DBG_CTL_STATUS on running systems to confirm whether the workaround bits (TM5, TM6, TM9, TM11) match the patched configuration
Correlate sudden TX throughput drops with concurrent SQ activity sharing a single SMQ

Monitoring Recommendations

Forward kernel logs from OcteonTX2-based appliances into a centralized log analytics or SIEM pipeline for stall pattern detection
Track per-queue TX drop and credit counters exposed by the driver to detect early-stage credit loss
Alert on any kernel version running octeontx2-af that predates the fix commits listed in the kernel.org references

How to Mitigate CVE-2026-43296

Immediate Actions Required

Identify Linux hosts and embedded appliances using Marvell OcteonTX2 networking with the octeontx2-af driver loaded
Upgrade to a Linux stable release containing one of the fix commits referenced by kernel.org
For systems that cannot be patched immediately, schedule maintenance windows for kernel updates and prepare failover for the affected network paths

Patch Information

The fix programs NIX_AF_SQM_DBG_CTL_STATUS to disable the problematic sticky behavior: clearing TM6 (bit 15) and TM11 (bit 14) disables SQM sticky operation, clearing TM5 (bit 23) removes the deadlock-prone sticky to non-sticky transition path, and setting TM9 (bit 21) keeps the control-flow clock enabled to prevent credit drops. Patched commits include 36cc5a5, 70e9a57, 8052d05, 9a3fd30, b7eba26, cec2ceb, d0b3c8a, and d9b549b.

Workarounds

Reduce concurrency by binding workloads so that multiple SQs do not share a single SMQ where feasible
Restrict untrusted network traffic to affected interfaces using upstream filtering until the patched kernel is deployed
Use platform watchdogs to recover stalled interfaces automatically while a maintenance patch window is scheduled

bash

# Verify the running kernel and octeontx2-af driver version
uname -r
modinfo octeontx2_af | grep -E '^(version|srcversion):'

# Confirm the workaround configuration after patching (root required)
# Read NIX_AF_SQM_DBG_CTL_STATUS via the driver's debugfs interface
ls /sys/kernel/debug/octeontx2/