CVE-2026-74698: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74698 Overview

CVE-2026-74698 is a Linux kernel vulnerability in the Mellanox 5 Ethernet driver (net/mlx5e). The flaw resides in the send queue (SQ) re-activation path, where mlx5e_queue_start() deactivates and re-activates all channels while closing only the queue being restarted. The subsequent unconditional call to netdev_tx_reset_queue() inside mlx5e_activate_txqsq() zeroes the Byte Queue Limits (BQL) counters of channels that still hold in-flight transmit Work Queue Elements (WQEs). The next completion over-charges the dynamic queue limits accounting and trips the BUG_ON() at lib/dynamic_queue_limits.c:99, causing a kernel panic.

Critical Impact
A completion on a queue with in-flight WQEs triggers a kernel BUG_ON() in dql_completed(), resulting in a denial-of-service condition on hosts using Mellanox ConnectX adapters.

Affected Products

Linux kernel net/mlx5e driver (Mellanox ConnectX Ethernet)
Upstream stable branches prior to the fix commits 88664c48d7d1, d2897717cd22, and e7386770be1b
Distributions shipping vulnerable Linux kernel versions with the mlx5 driver enabled

Discovery Timeline

2026-08-22 - CVE-2026-74698 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74698

Vulnerability Analysis

The issue is a state-tracking bug in the mlx5 Ethernet driver's queue restart logic. When a single transmit queue restarts, mlx5e_queue_start() deactivates every channel on the device but closes only the target queue. Channels that remain open retain outstanding transmit WQEs whose byte counts are still tracked by the kernel's BQL subsystem. When those channels are re-activated, mlx5e_activate_txqsq() unconditionally invokes netdev_tx_reset_queue(), clearing the BQL counters for queues that still owe completions.

On the next TX completion, dql_completed() attempts to decrement counters that were forcibly zeroed, producing an unsigned underflow that violates the invariant enforced by BUG_ON(). The crash trace shows the fault in mlx5e_poll_tx_cq() from mlx5e_napi_poll() during softirq context. Because the failure lives inside NAPI polling, recovery requires a reboot. The fix restricts the BQL reset to cases where sq->cc == sq->pc (no bytes in flight); otherwise outstanding WQEs are allowed to drain naturally, and the carried dql->limit self-rebalances.

Root Cause

The root cause is unconditional invocation of netdev_tx_reset_queue() during SQ re-activation without verifying that the send queue producer counter (sq->pc) matches the consumer counter (sq->cc). This desynchronizes BQL bookkeeping from actual in-flight bytes.

Attack Vector

The condition is triggered by transmit queue restart events, which typically occur under legitimate operational paths such as XDP reconfiguration, queue count changes, or error recovery. No verified remote exploitation vector or proof-of-concept has been published for CVE-2026-74698, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploitation code available.
// Refer to the upstream fix commits for the patched logic:
//   git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1
//   git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800
//   git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430

Detection Methods for CVE-2026-74698

Indicators of Compromise

Kernel panic messages referencing kernel BUG at lib/dynamic_queue_limits.c:99 in system logs.
Stack traces showing dql_completed+0x23d/0x280, mlx5e_poll_tx_cq, and mlx5e_napi_poll in the crash backtrace.
Unexpected host reboots or NIC hangs on servers using Mellanox ConnectX adapters during queue reconfiguration events.

Detection Strategies

Monitor dmesg and journalctl output for BUG_ON events originating from the mlx5 driver on hosts with ConnectX NICs.
Correlate kernel crash dumps (kdump, pstore) against the vulnerable call trace to confirm exposure to CVE-2026-74698.
Inventory running kernels using uname -r and cross-reference against the patched stable versions containing commits 88664c48d7d1, d2897717cd22, or e7386770be1b.

Monitoring Recommendations

Alert on repeated NAPI-related kernel oops or panics on network-heavy hosts, especially during XDP or queue-count changes.
Track host availability metrics for systems with mlx5 drivers to detect reboot patterns consistent with this crash.
Forward kernel logs to a centralized log platform to enable retroactive search for the dql_completed signature.

How to Mitigate CVE-2026-74698

Immediate Actions Required

Identify all Linux hosts running Mellanox ConnectX network adapters with the mlx5_core and mlx5_en modules loaded.
Schedule kernel upgrades to a version containing the upstream fix commits referenced in the kernel.org stable tree.
Avoid operations that trigger SQ restarts (queue count changes, XDP program attach/detach) on unpatched hosts until updated.

Patch Information

The fix modifies mlx5e_activate_txqsq() to reset BQL counters via netdev_tx_reset_queue() only when the send queue has no bytes in flight (sq->cc == sq->pc). When the reset is skipped, outstanding WQEs complete normally and the dynamic queue limit rebalances itself while the dql->limit value is preserved across the restart. Apply the upstream patches referenced as commit 88664c48d7d1, commit d2897717cd22, and commit e7386770be1b, or upgrade to a distribution kernel that has backported them.

Workarounds

Minimize runtime operations that force TX queue restarts on affected kernels, including channel count changes via ethtool -L.
Where feasible, quiesce transmit traffic on the affected interface before reconfiguring queues to reduce the likelihood of in-flight WQEs during a reset.
Enable kdump to capture crash artifacts for forensic review if the panic occurs before patching completes.

bash

# Verify running kernel and mlx5 driver presence
uname -r
lsmod | grep mlx5

# Inspect current TX queue configuration before making changes
ethtool -l <ifname>

# Review kernel logs for prior occurrences of the crash signature
dmesg | grep -E 'dql_completed|mlx5e_poll_tx_cq'