CVE-2026-43464

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43464", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.011Z", "datePublished": "2026-05-08T14:22:26.039Z", "dateUpdated": "2026-10-21T12:40:49.291Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:49.291Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn't change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nSuch issue can be observed with the\ntest_xdp_native_adjst_tail_shrnk_data selftest when using a payload of\n3600 and shrinking by 256 bytes (an upcoming selftest patch): the last\nfragment gets released by the XDP code but doesn't get tracked by the\ndriver. This results in a negative pp_ref_count during page release and\nthe following splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n <TASK>\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable mlx5e RX path is reached by packets received on a Mellanox Ethernet interface, before any network-layer authentication. A remote peer can supply the packet sizes and traffic needed to enter the multi-buffer receive path.\nAC:L - Once an affected deployment has an XDP multi-buffer program using layout-changing helpers, triggering only requires sending packets that span fragments and cause the program to shrink or pull data. The packet pattern is attacker-controlled and no race or hard-to-hit timing condition is required.\nPR:N - The attacker does not need local privileges or credentials to send packets to the affected interface. Attaching the XDP program is a deployment precondition, but the vulnerable receive path itself is unauthenticated packet processing.\nUI:N - No victim user action is needed after the affected interface and XDP program are in service. Packet reception alone drives the vulnerable code.\nS:U - The bug corrupts accounting inside the same kernel/network-device security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The investigated bug is a page-pool fragment reference accounting undercount that leads to negative reference counts and warnings, not an exposed arbitrary read or bounded information leak. The fixed code corrects lifetime accounting rather than a data disclosure path.\nI:N - The issue does not provide a demonstrated primitive for attacker-controlled data modification or control-flow hijack. The corruption is limited to page-pool reference accounting for receive buffers.\nA:H - The malformed accounting triggers WARN_ON splats in page_pool release and can be driven repeatedly through received traffic followed by normal queue teardown or reconfiguration. In severe reasonable deployments, including systems with panic_on_warn or exhausted RX page-pool resources, this can cause a kernel-level denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "versions": [{"version": "72328f25755ee966724f46e3a0e8e59bef2091ba", "lessThan": "1106412414dc3ee62999115be10ca83199b02108", "status": "affected", "versionType": "git"}, {"version": "0049fd63881505566824e88cfa624638f921c808", "lessThan": "9488ee96b4f53d2aed474c744f0ed64f61d1dcc9", "status": "affected", "versionType": "git"}, {"version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "c74557495efb4bd0adefdfc8678ecdbc82a06da3", "status": "affected", "versionType": "git"}, {"version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "03cb50e5b74fce8bf6d92b860371b66253cf0f8d", "status": "affected", "versionType": "git"}, {"version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "lessThan": "a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa", "status": "affected", "versionType": "git"}, {"version": "d969645b9b7810289bf3c353ea06957373756b8e", "status": "affected", "versionType": "git"}, {"version": "6.6.115", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.56", "lessThan": "6.12.114", "status": "affected", "versionType": "semver"}, {"version": "6.17.6", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.115", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.56", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1106412414dc3ee62999115be10ca83199b02108"}, {"url": "https://git.kernel.org/stable/c/9488ee96b4f53d2aed474c744f0ed64f61d1dcc9"}, {"url": "https://git.kernel.org/stable/c/c74557495efb4bd0adefdfc8678ecdbc82a06da3"}, {"url": "https://git.kernel.org/stable/c/03cb50e5b74fce8bf6d92b860371b66253cf0f8d"}, {"url": "https://git.kernel.org/stable/c/a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa"}], "title": "net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1106412414dc3ee62999115be10ca83199b02108", "status": "affected", "version": "72328f25755ee966724f46e3a0e8e59bef2091ba", "versionType": "git"}, {"lessThan": "9488ee96b4f53d2aed474c744f0ed64f61d1dcc9", "status": "affected", "version": "0049fd63881505566824e88cfa624638f921c808", "versionType": "git"}, {"lessThan": "c74557495efb4bd0adefdfc8678ecdbc82a06da3", "status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "versionType": "git"}, {"lessThan": "03cb50e5b74fce8bf6d92b860371b66253cf0f8d", "status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "versionType": "git"}, {"lessThan": "a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa", "status": "affected", "version": "afd5ba577c10639f62e8120df67dc70ea4b61176", "versionType": "git"}, {"status": "affected", "version": "d969645b9b7810289bf3c353ea06957373756b8e", "versionType": "git"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.115", "versionType": "semver"}, {"lessThan": "6.12.114", "status": "affected", "version": "6.12.56", "versionType": "semver"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E81F0DE3-D6B1-41D7-B6E1-1B9D9E102EFA", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.115", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6635FA2E-5F6F-4D2C-8880-447F4C4951B7", "versionEndExcluding": "6.13", "versionStartIncluding": "6.12.56", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B7EFF9F-4A45-4CD5-85D2-F68BD7D7F5B3", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F718F75-20D5-4D17-B698-1D1BD5FDE294", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*", "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*", "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*", "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*", "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*", "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn't change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nSuch issue can be observed with the\ntest_xdp_native_adjst_tail_shrnk_data selftest when using a payload of\n3600 and shrinking by 256 bytes (an upcoming selftest patch): the last\nfragment gets released by the XDP code but doesn't get tracked by the\ndriver. This results in a negative pp_ref_count during page release and\nthe following splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n <TASK>\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5e: RX, Correcci\u00f3n del conteo de fragmentos multi-buffer XDP para RQ heredado\n\nLos programas XDP multi-buffer pueden modificar la disposici\u00f3n del buffer XDP cuando el programa llama a bpf_xdp_pull_data() o bpf_xdp_adjust_tail(). El commit referenciado en la etiqueta \u2019fixes\u2019 corrigi\u00f3 la suposici\u00f3n en el controlador mlx5 de que la disposici\u00f3n del buffer XDP no cambia durante la ejecuci\u00f3n de un programa. Sin embargo, esta correcci\u00f3n introdujo otro problema: los fragmentos descartados a\u00fan necesitan ser contados por parte del controlador para evitar problemas de conteo de referencias de fragmentos de p\u00e1gina.\n\nTal problema puede observarse con la autoprueba test_xdp_native_adjst_tail_shrnk_data al usar una carga \u00fatil de 3600 y reducir en 256 bytes (un parche de autoprueba pr\u00f3ximo): el \u00faltimo fragmento es liberado por el c\u00f3digo XDP pero no es rastreado por el controlador. Esto resulta en un pp_ref_count negativo durante la liberaci\u00f3n de p\u00e1gina y el siguiente splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n [TASK]\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x 1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nEste parche corrige el problema al realizar el conteo de fragmentos de p\u00e1gina en todos los fragmentos originales del buffer XDP para todas las acciones XDP relevantes (XDP_TX, XDP_REDIRECT y XDP_PASS). Esto es b\u00e1sicamente revertir al conteo original antes del commit en la etiqueta \u2019fixes\u2019.\n\nComo frag_page sigue apuntando a la cola original, el par\u00e1metro nr_frags para xdp_update_skb_frags_info() necesita ser calculado de una manera diferente para reflejar el nuevo nr_frags."}], "id": "CVE-2026-43464", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-08T15:16:59.283", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03cb50e5b74fce8bf6d92b860371b66253cf0f8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1106412414dc3ee62999115be10ca83199b02108"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9488ee96b4f53d2aed474c744f0ed64f61d1dcc9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c74557495efb4bd0adefdfc8678ecdbc82a06da3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ", "id": "2468236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468236"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's mlx5e driver. When using eXpress Data Path (XDP) multi-buffer programs, an attacker could manipulate the XDP buffer layout. This manipulation leads to incorrect tracking of page fragments, causing a critical error in memory management. The issue can result in a system crash or denial of service."], "name": "CVE-2026-43464", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43464\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43464\nhttps://lore.kernel.org/linux-cve-announce/2026050802-CVE-2026-43464-5c7a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afd5ba577c10639f62e8120df67dc70ea4b61176,c74557495efb4bd0adefdfc8678ecdbc82a06da3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afd5ba577c10639f62e8120df67dc70ea4b61176,03cb50e5b74fce8bf6d92b860371b66253cf0f8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afd5ba577c10639f62e8120df67dc70ea4b61176,a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "72328f25755ee966724f46e3a0e8e59bef2091ba"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0049fd63881505566824e88cfa624638f921c808"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "d969645b9b7810289bf3c353ea06957373756b8e"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T19:15:14.827791+00:00", "updated": "2026-05-20T19:30:37.775935+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}