[SRU][Q][PATCH 0/1] CVE-2026-43465

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43465

[ Impact ]

XDP multi-buf programs can modify the layout of the XDP buffer when the program
calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The mlx5e striding RQ RX
path failed to count dropped fragments on the driver side, leading to page
fragment reference counting errors. When a fragment was dropped by an XDP
program, mlx5 skipped counting it while still releasing all fragments of the
page, causing a negative page_pool reference count and triggering a kernel
warning during RX queue teardown.

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

If the fix is incorrect, fragment counting in the mlx5e striding RQ RX path
could be miscalculated, potentially causing page_pool reference counting
errors, memory corruption, or RX path instability on mlx5 hardware running XDP
multi-buf programs.