CVE-2026-43296

A flaw was found in the Linux kernel's octeontx2-af driver. This vulnerability arises from issues within the NIX SQ (Send Queue) manager's sticky mode and the PSE (Packet Stream Engine), which can lead to system stalls, deadlocks, and credit drops. When multiple Send Queues share a Send Message Queue (SMQ) and transmit concurrently, or during transitions between sticky and non-sticky transmissions, a denial of service condition can occur, impacting system availability and performance.

A moderate-impact denial of service flaw was found in the Linux kernel's octeontx2-af driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. OcteonTX2 hardware errata can cause the NIX send queue (SQ) manager to stall when multiple SQs sharing a send message queue (SMQ) transmit concurrently, the Packet Stream Engine (PSE) to deadlock on transitions between sticky and non-sticky transmissions, and credits to be dropped when certain condition clocks are gated. A local attacker able to run workloads or generate transmit traffic on the host can trigger these stalls, deadlocks, and credit drops, resulting in loss of network forward progress and degraded system availability on affected OcteonTX2 hardware. Red Hat rates this flaw with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org score of 7.5, which assumes an unauthenticated network vector; reliable triggering requires local access and concurrent transmit activity on the affected hardware. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 9 and 10 streams, the fix is deferred and will be addressed in a future update; the upstream change works around the hardware errata by disabling the SQM sticky-mode optimizations via NIX_AF_SQM_DBG_CTL_STATUS, and the residual risk is a local denial of service limited to transmit path availability on systems using affected OcteonTX2 hardware. Certain affected streams are out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.