CVE-2026-43466

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery<br /> <br /> In case of a TX error CQE, a recovery flow is triggered,<br /> mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,<br /> desyncing the DMA FIFO producer and consumer.<br /> <br /> After recovery, the producer pushes new DMA entries at the old<br /> dma_fifo_pc, while the consumer reads from position 0.<br /> This causes us to unmap stale DMA addresses from before the recovery.<br /> <br /> The DMA FIFO is a purely software construct with no HW counterpart.<br /> At the point of reset, all WQEs have been flushed so dma_fifo_cc is<br /> already equal to dma_fifo_pc. There is no need to reset either counter,<br /> similar to how skb_fifo pc/cc are untouched.<br /> <br /> Remove the &amp;#39;dma_fifo_cc = 0&amp;#39; reset.<br /> <br /> This fixes the following WARNING:<br /> WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90<br /> Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]<br /> CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014<br /> RIP: 0010:iommu_dma_unmap_page+0x79/0x90<br /> Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00<br /> Call Trace:<br /> <br /> ? __warn+0x7d/0x110<br /> ? iommu_dma_unmap_page+0x79/0x90<br /> ? report_bug+0x16d/0x180<br /> ? handle_bug+0x4f/0x90<br /> ? exc_invalid_op+0x14/0x70<br /> ? asm_exc_invalid_op+0x16/0x20<br /> ? iommu_dma_unmap_page+0x79/0x90<br /> ? iommu_dma_unmap_page+0x2e/0x90<br /> dma_unmap_page_attrs+0x10d/0x1b0<br /> mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]<br /> mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]<br /> mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]<br /> __napi_poll+0x24/0x190<br /> net_rx_action+0x32a/0x3b0<br /> ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]<br /> ? notifier_call_chain+0x35/0xa0<br /> handle_softirqs+0xc9/0x270<br /> irq_exit_rcu+0x71/0xd0<br /> common_interrupt+0x7f/0xa0<br /> <br /> <br /> asm_common_interrupt+0x22/0x40