ACK: [SRU][Q][PATCH 0/1] CVE-2026-43465

[Jian Hui Lee]

Acked-by: Jian Hui Lee <jianhui.lee at canonical.com>

On Tue, Jun 23, 2026 at 12:21 PM Cengiz Can via kernel-team
<kernel-team at lists.ubuntu.com> wrote:
>
> https://ubuntu.com/security/CVE-2026-43465
>
> [ Impact ]
>
> XDP multi-buf programs can modify the layout of the XDP buffer when the program
> calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The mlx5e striding RQ RX
> path failed to count dropped fragments on the driver side, leading to page
> fragment reference counting errors. When a fragment was dropped by an XDP
> program, mlx5 skipped counting it while still releasing all fragments of the
> page, causing a negative page_pool reference count and triggering a kernel
> warning during RX queue teardown.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> If the fix is incorrect, fragment counting in the mlx5e striding RQ RX path
> could be miscalculated, potentially causing page_pool reference counting
> errors, memory corruption, or RX path instability on mlx5 hardware running XDP
> multi-buf programs.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team