[SRU][N][PATCH 0/1] CVE-2026-43465

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43465

[ Impact ]

The mlx5 driver mishandles XDP multi-buf fragment counting for striding RQ.
When an XDP multi-buf program changes the buffer layout via bpf_xdp_pull_data()
or bpf_xdp_adjust_tail() and drops a tail fragment, the driver skips counting
that fragment, leaving its internal frag counter out of sync with the page_pool
reference count. This leads to negative page reference counting errors and
triggers a warning splat when the RX queue is torn down, corrupting page_pool
accounting and potentially destabilizing the system.

[ Fix ]

noble: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect the mlx5e RX datapath, specifically XDP
multi-buf handling for striding RQ. Incorrect fragment counting could
reintroduce page_pool reference leaks or premature page releases, leading to
memory corruption or crashes on systems using ConnectX hardware with XDP
programs.