CVE-2026-74698
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUG_ON() in dql_completed(): kernel BUG at lib/dynamic_queue_limits.c:99! RIP: 0010:dql_completed+0x23d/0x280 Call Trace: <IRQ> mlx5e_poll_tx_cq+0x668/0xa60 mlx5e_napi_poll+0x5b/0x7b0 net_rx_action+0x15a/0x580 Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc). In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.
Affected versions
Linux kernel versions
6.17
and later are affected. Fixed in
6.18.45,
7.1.9,
7.2
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-74698?
CVE-2026-74698 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.17 onward and has been patched in 6.18.45, 7.1.9 and 7.2. CVE-2026-74698 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74698?
Yes. CVE-2026-74698 has been patched. Fixed versions include 6.18.45, 7.1.9 and 7.2. If you are running Linux kernel 6.17 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74698 actively exploited?
No. CVE-2026-74698 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.