CVE-2026-43464: Linux Kernel Privilege Escalation Flaw

CVE-2026-43464 Overview

CVE-2026-43464 is a Linux kernel vulnerability in the net/mlx5e driver affecting receive (RX) processing on legacy receive queues (RQs). The flaw stems from incorrect XDP (eXpress Data Path) multi-buffer fragment counting when XDP programs modify the buffer layout via bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). Dropped fragments are not properly tracked on the driver side, leading to page fragment reference counting issues and a negative pp_ref_count during page release. This triggers a kernel warning in mlx5e_page_release_fragmented() and can disrupt network operations on systems using Mellanox ConnectX adapters with XDP programs attached.

Critical Impact
Network-adjacent attackers can trigger driver-level page reference counting corruption that destabilizes networking on Mellanox-equipped Linux hosts.

Affected Products

Linux kernel net/mlx5e driver (legacy RQ mode)
Systems using Mellanox/NVIDIA ConnectX adapters with XDP multi-buffer programs
Kernel versions including 6.19.0-rc3 prior to the fix commits

Discovery Timeline

2026-05-08 - CVE-2026-43464 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43464

Vulnerability Analysis

The vulnerability resides in the Mellanox mlx5e Ethernet driver's RX path for legacy receive queues. XDP multi-buffer programs can modify the XDP buffer layout by invoking helpers such as bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). A prior fix corrected the driver's assumption that the buffer layout remained static during XDP program execution. However, that fix introduced a regression: fragments released by the XDP code were no longer counted on the driver side, breaking page fragment reference accounting.

When the dropped fragments are not tracked, the page pool's pp_ref_count decrements below zero during page release. This triggers a WARN at include/net/page_pool/helpers.h:297 inside mlx5e_page_release_fragmented(), observable during operations such as MTU changes that close and reopen RX queues.

Root Cause

The root cause is missing fragment count bookkeeping for XDP actions XDP_TX, XDP_REDIRECT, and XDP_PASS when an XDP multi-buffer program shrinks the buffer via tail adjustment. Because frag_page continues to reference the original tail after shrinkage, the driver requires a recalculated nr_frags value passed to xdp_update_skb_frags_info(). Without this, page pool reference counts diverge from the actual fragments held.

Attack Vector

The issue is reachable on hosts running an XDP multi-buffer program on a Mellanox mlx5e legacy RQ interface. Crafted packet payloads that traverse XDP paths invoking tail adjustment, such as a 3600-byte payload shrunk by 256 bytes as demonstrated by the test_xdp_native_adjst_tail_shrnk_data selftest, exercise the faulty path. Repeated triggering leads to page pool corruption and a denial-of-service condition on the affected interface.

No verified public exploit code is available. Refer to the upstream kernel commits for the technical patch details.

Detection Methods for CVE-2026-43464

Indicators of Compromise

Kernel WARNING messages referencing mlx5e_page_release_fragmented in dmesg or journalctl output
Splat traces including mlx5e_dealloc_rx_wqe, mlx5e_free_rx_descs, and mlx5e_close_rq call paths
Unexplained RX queue resets or interface stalls on Mellanox ConnectX adapters with XDP attached

Detection Strategies

Monitor kernel logs for page pool reference counting warnings from include/net/page_pool/helpers.h
Inventory hosts running mlx5_core with attached XDP multi-buffer programs and compare kernel versions against patched commits
Validate XDP selftest behavior, particularly test_xdp_native_adjst_tail_shrnk_data, in pre-production environments

Monitoring Recommendations

Forward dmesg and journald events to a centralized log platform to flag mlx5e and page_pool warnings
Track interface flap and MTU change events that coincide with kernel warnings
Alert on repeated WARN_ON occurrences from networking subsystems on hosts with high-throughput XDP workloads

How to Mitigate CVE-2026-43464

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits to all affected hosts
Identify hosts running Mellanox mlx5e drivers with XDP multi-buffer programs and prioritize them for patching
Restrict deployment of untrusted XDP programs that call bpf_xdp_adjust_tail() or bpf_xdp_pull_data() until patched

Patch Information

The fix restores page fragment counting on all original XDP buffer fragments for XDP_TX, XDP_REDIRECT, and XDP_PASS actions, and recalculates the nr_frags argument to xdp_update_skb_frags_info() to reflect the post-shrink fragment count. Patched commits are available at Kernel Git Commit 03cb50e, Kernel Git Commit a6413e6, and Kernel Git Commit c745574.

Workarounds

Detach XDP multi-buffer programs from mlx5e interfaces on legacy RQ until the kernel is patched
Avoid XDP programs that invoke bpf_xdp_adjust_tail() or bpf_xdp_pull_data() on affected systems
Where supported, switch to striding RQ mode, which uses a different RX path not subject to this counting flaw

bash

# Detach XDP program from a Mellanox interface as a temporary workaround
ip link set dev eth0 xdp off

# Verify XDP is no longer attached
ip link show dev eth0 | grep -i xdp