ACK: [SRU][Q][PATCH 0/1] CVE-2026-43465

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 12:20, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43465
>
> [ Impact ]
>
> XDP multi-buf programs can modify the layout of the XDP buffer when the program
> calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The mlx5e striding RQ RX
> path failed to count dropped fragments on the driver side, leading to page
> fragment reference counting errors. When a fragment was dropped by an XDP
> program, mlx5 skipped counting it while still releasing all fragments of the
> page, causing a negative page_pool reference count and triggering a kernel
> warning during RX queue teardown.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> If the fix is incorrect, fragment counting in the mlx5e striding RQ RX path
> could be miscalculated, potentially causing page_pool reference counting
> errors, memory corruption, or RX path instability on mlx5 hardware running XDP
> multi-buf programs.
>