CVE-2026-74698
- Source
- https://cve.org/CVERecord?id=CVE-2026-74698
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74698.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-74698
- Downstream
- Published
- 2026-08-22T15:32:59.703Z
- Modified
- 2026-08-24T11:47:18.965506428Z
- Summary
- net/mlx5e: fix BQL reset on SQ re-activation
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: fix BQL reset on SQ re-activation
mlx5equeuestart() deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq() then unconditionally calls netdevtxresetqueue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUGON() in dql_completed():
kernel BUG at lib/dynamicqueuelimits.c:99! RIP: 0010:dqlcompleted+0x23d/0x280 Call Trace: <IRQ> mlx5epolltxcq+0x668/0xa60 mlx5enapipoll+0x5b/0x7b0 netrxaction+0x15a/0x580
Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).
In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74698.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1
- https://git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800
- https://git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74698.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-74698
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git