ACK: [SRU][N][PATCH 0/1] CVE-2026-43465

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 09:12, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43465
>
> [ Impact ]
>
> The mlx5 driver mishandles XDP multi-buf fragment counting for striding RQ.
> When an XDP multi-buf program changes the buffer layout via bpf_xdp_pull_data()
> or bpf_xdp_adjust_tail() and drops a tail fragment, the driver skips counting
> that fragment, leaving its internal frag counter out of sync with the page_pool
> reference count. This leads to negative page reference counting errors and
> triggers a warning splat when the RX queue is torn down, corrupting page_pool
> accounting and potentially destabilizing the system.
>
> [ Fix ]
>
> noble: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect the mlx5e RX datapath, specifically XDP
> multi-buf handling for striding RQ. Incorrect fragment counting could
> reintroduce page_pool reference leaks or premature page releases, leading to
> memory corruption or crashes on systems using ConnectX hardware with XDP
> programs.
>