CVE-2026-74698

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74698", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.927Z", "datePublished": "2026-08-22T15:32:59.703Z", "dateUpdated": "2026-08-22T15:32:59.703Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:59.703Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix BQL reset on SQ re-activation\n\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted. mlx5e_activate_txqsq() then\nunconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters\nof channels that kept their in-flight TX WQEs. The next completion then\nover-charges and trips the BUG_ON() in dql_completed():\n\n kernel BUG at lib/dynamic_queue_limits.c:99!\n RIP: 0010:dql_completed+0x23d/0x280\n Call Trace:\n <IRQ>\n mlx5e_poll_tx_cq+0x668/0xa60\n mlx5e_napi_poll+0x5b/0x7b0\n net_rx_action+0x15a/0x580\n\nReset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).\n\nIn the case that reset is skipped, the outstanding WQEs will eventually\ncomplete and rebalance the dql. The dql->limit is carried across the\nreset."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "versions": [{"version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "lessThan": "88664c48d7d1eca8e1ac92da85c89c26af741cf1", "status": "affected", "versionType": "git"}, {"version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "lessThan": "d2897717cd222e575599d903d885c48602699800", "status": "affected", "versionType": "git"}, {"version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "lessThan": "e7386770be1bf810bcd6af39d1e4bfeab3408430", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1"}, {"url": "https://git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800"}, {"url": "https://git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430"}], "title": "net/mlx5e: fix BQL reset on SQ re-activation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "88664c48d7d1eca8e1ac92da85c89c26af741cf1", "status": "affected", "version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "versionType": "git"}, {"lessThan": "d2897717cd222e575599d903d885c48602699800", "status": "affected", "version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "versionType": "git"}, {"lessThan": "e7386770be1bf810bcd6af39d1e4bfeab3408430", "status": "affected", "version": "b2588ea40ec9472688289c1a644627c0f4a1f33f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix BQL reset on SQ re-activation\n\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted. mlx5e_activate_txqsq() then\nunconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters\nof channels that kept their in-flight TX WQEs. The next completion then\nover-charges and trips the BUG_ON() in dql_completed():\n\n kernel BUG at lib/dynamic_queue_limits.c:99!\n RIP: 0010:dql_completed+0x23d/0x280\n Call Trace:\n <IRQ>\n mlx5e_poll_tx_cq+0x668/0xa60\n mlx5e_napi_poll+0x5b/0x7b0\n net_rx_action+0x15a/0x580\n\nReset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).\n\nIn the case that reset is skipped, the outstanding WQEs will eventually\ncomplete and rebalance the dql. The dql->limit is carried across the\nreset."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5e: corrige el reinicio de BQL en la reactivaci\u00f3n de SQ\n\nmlx5e_queue_start() desactiva y reactiva todos los canales, pero cierra solo la cola que se est\u00e1 reiniciando. mlx5e_activate_txqsq() luego llama incondicionalmente a netdev_tx_reset_queue(), poniendo a cero los contadores BQL de los canales que mantuvieron sus WQE TX en vuelo. La siguiente finalizaci\u00f3n luego sobrecarga y activa el BUG_ON() en dql_completed():\n\nBUG del kernel en lib/dynamic_queue_limits.c:99!\nRIP: 0010:dql_completed+0x23d/0x280\nTraza de Llamadas:\n <IRQ>\n mlx5e_poll_tx_cq+0x668/0xa60\n mlx5e_napi_poll+0x5b/0x7b0\n net_rx_action+0x15a/0x580\n\nReinicia BQL solo cuando el SQ no tiene bytes en vuelo (sq -> cc == sq -> pc).\n\nEn el caso de que se omita el reinicio, los WQE pendientes finalmente se completar\u00e1n y reequilibrar\u00e1n el dql. El dql -> limit se mantiene a trav\u00e9s del reinicio."}], "id": "CVE-2026-74698", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:44.397", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/mlx5e: fix BQL reset on SQ re-activation", "id": "2521491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521491"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: fix BQL reset on SQ re-activation\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted. mlx5e_activate_txqsq() then\nunconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters\nof channels that kept their in-flight TX WQEs. The next completion then\nover-charges and trips the BUG_ON() in dql_completed():\nkernel BUG at lib/dynamic_queue_limits.c:99!\nRIP: 0010:dql_completed+0x23d/0x280\nCall Trace:\n<IRQ>\nmlx5e_poll_tx_cq+0x668/0xa60\nmlx5e_napi_poll+0x5b/0x7b0\nnet_rx_action+0x15a/0x580\nReset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).\nIn the case that reset is skipped, the outstanding WQEs will eventually\ncomplete and rebalance the dql. The dql->limit is carried across the\nreset.", "A flaw was found in the Linux kernel's `net/mlx5e` driver. When a Send Queue (SQ) is re-activated, the Byte Queue Limits (BQL) counters are incorrectly reset even if there are still network transmissions in progress. This can lead to an inconsistent state, causing the kernel to trigger an error and resulting in a system crash, effectively a denial of service."], "name": "CVE-2026-74698", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74698\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74698\nhttps://lore.kernel.org/linux-cve-announce/2026082235-CVE-2026-74698-16c4@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b2588ea40ec9472688289c1a644627c0f4a1f33f,88664c48d7d1eca8e1ac92da85c89c26af741cf1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b2588ea40ec9472688289c1a644627c0f4a1f33f,d2897717cd222e575599d903d885c48602699800)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b2588ea40ec9472688289c1a644627c0f4a1f33f,e7386770be1bf810bcd6af39d1e4bfeab3408430)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.45,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:00:14.810626+00:00", "updated": "2026-08-25T14:45:03.958591+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}