CVE-2026-74698 PUBLISHED

net/mlx5e: fix BQL reset on SQ re-activation

Assigner: Linux
Reserved: 15.08.2026 Published: 22.08.2026 Updated: 22.08.2026

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix BQL reset on SQ re-activation

mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUG_ON() in dql_completed():

kernel BUG at lib/dynamic_queue_limits.c:99! RIP: 0010:dql_completed+0x23d/0x280 Call Trace: <IRQ> mlx5e_poll_tx_cq+0x668/0xa60 mlx5e_napi_poll+0x5b/0x7b0 net_rx_action+0x15a/0x580

Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).

In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from b2588ea40ec9472688289c1a644627c0f4a1f33f to 88664c48d7d1eca8e1ac92da85c89c26af741cf1 (excl.)
  • affected from b2588ea40ec9472688289c1a644627c0f4a1f33f to d2897717cd222e575599d903d885c48602699800 (excl.)
  • affected from b2588ea40ec9472688289c1a644627c0f4a1f33f to e7386770be1bf810bcd6af39d1e4bfeab3408430 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.17 is affected
  • unaffected from 0 to 6.17 (excl.)
  • unaffected from 6.18.45 to 6.18.* (incl.)
  • unaffected from 7.1.9 to 7.1.* (incl.)
  • unaffected from 7.2 to * (incl.)

References