CVE-2026-52983: Linux Kernel BQL Imbalance DoS Vulnerability

CVE-2026-52983 Overview

CVE-2026-52983 is a Linux kernel vulnerability in the airoha network driver. The flaw resides in the transmit (TX) path of airoha_dev_xmit(), where Byte Queue Limits (BQL) accounting becomes inconsistent. Inflight packets are accounted for only the AIROHA_NUM_TX_RING netdev TX queues, while airoha_qdma_tx_napi_poll() accounts completions across all netdev TX queues (num_tx_queues). This mismatch produces a BQL imbalance and can disrupt TX queue state tracking. The fix also resets all netdev TX queues in the ndo_stop callback. The issue was resolved through upstream kernel commits.

Critical Impact
BQL accounting inconsistencies in the airoha driver TX path can cause queue stalls and degraded network throughput on affected Linux systems.

Affected Products

Linux kernel versions containing the airoha Ethernet driver prior to the fix
Systems using Airoha QDMA-based network hardware
Distributions shipping vulnerable stable kernels referenced in the upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-52983 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52983

Vulnerability Analysis

The vulnerability is a kernel driver logic flaw in the Airoha Ethernet driver's transmit path. Byte Queue Limits (BQL) is a Linux networking mechanism that limits the amount of data queued on a network device to reduce bufferbloat. Correct BQL operation requires symmetric accounting: bytes enqueued in the transmit path must match bytes completed and reported back to the same TX queue.

In airoha_dev_xmit(), the queue index is computed using a modulo operation:

qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx)

This maps skbs only to the AIROHA_NUM_TX_RING queues, so BQL enqueue counts are recorded against that limited subset. However, airoha_qdma_tx_napi_poll() walks the full set of netdev TX queues (num_tx_queues) when accounting completions. The asymmetry causes BQL counters to drift, potentially leaving queues marked as stopped or producing inaccurate inflight byte counts.

Root Cause

The root cause is inconsistent queue indexing between enqueue and completion code paths. Enqueue uses a modulo-reduced queue index bounded by the hardware ring count, while completion iterates over the netdev's full TX queue set. The ndo_stop callback also failed to reset all netdev TX queues, leaving stale state across interface restarts.

Attack Vector

This is a stability and reliability defect rather than a remotely exploitable memory safety issue. No CWE has been assigned and no exploit is known. The condition is triggered by normal multi-queue TX workloads on hardware using the Airoha QDMA driver. See the upstream fixes in Kernel Commit 2d9f5a1, Kernel Commit aaad53a5, and Kernel Commit ded26942 for technical details.

Detection Methods for CVE-2026-52983

Indicators of Compromise

No malicious indicators apply — this is a kernel reliability defect rather than an exploited vulnerability.
Symptoms include stalled TX queues, dropped packets, or persistent NETDEV WATCHDOG warnings on devices using the Airoha driver.
Unbalanced BQL counters reported via /sys/class/net/<iface>/queues/tx-*/byte_queue_limits/inflight.

Detection Strategies

Inventory Linux hosts running kernels with the airoha driver loaded and compare versions against the fixed stable releases.
Monitor ethtool -S <iface> counters for TX drops, requeues, and watchdog timeouts on Airoha-backed interfaces.
Inspect dmesg for repeated transmit timeout messages or queue reset events tied to the airoha_eth module.

Monitoring Recommendations

Track kernel version drift across fleet endpoints to confirm patched kernels are deployed on affected hardware.
Alert on sustained TX queue stalls or BQL inflight values that fail to drain under steady traffic.
Correlate network interface anomalies with kernel module load events through centralized log collection.

How to Mitigate CVE-2026-52983

Immediate Actions Required

Identify systems using Airoha QDMA networking hardware and the in-tree airoha_eth driver.
Update affected hosts to a Linux stable kernel that includes the upstream fixes referenced in the CVE.
Validate post-patch TX behavior under representative workloads to confirm BQL counters drain correctly.

Patch Information

The fix has been merged upstream and backported via the stable tree. See Kernel Commit 2d9f5a1, Kernel Commit aaad53a5, and Kernel Commit ded26942. The patches correct queue accounting symmetry in airoha_dev_xmit() and airoha_qdma_tx_napi_poll(), and reset all netdev TX queues in the ndo_stop callback.

Workarounds

No supported configuration workaround eliminates the BQL imbalance — apply the kernel patch.
Where patching is delayed, reduce reliance on multi-queue TX by limiting queues with ethtool -L <iface> tx 1 to minimize asymmetric accounting drift.
Restart the affected interface to clear stale BQL state after observed stalls until a patched kernel is deployed.

bash

# Verify kernel version and Airoha driver status
uname -r
lsmod | grep airoha_eth

# Inspect TX queue BQL inflight counters
for q in /sys/class/net/<iface>/queues/tx-*/byte_queue_limits/inflight; do
    echo "$q: $(cat $q)"
done

# Temporary mitigation: reduce TX queue count
ethtool -L <iface> tx 1