CVE-2026-74698

A flaw was found in the Linux kernel's net/mlx5e driver. When a Send Queue (SQ) is re-activated, the Byte Queue Limits (BQL) counters are incorrectly reset even if there are still network transmissions in progress. This can lead to an inconsistent state, causing the kernel to trigger an error and resulting in a system crash, effectively a denial of service.

A flaw of low impact was found in the Linux kernel's net/mlx5e driver, affecting the kernel in Red Hat Enterprise Linux 9.8, 9.9, 10.2 and 10.3 and in Red Hat In-Vehicle OS 2.0 and 2.1. When a Send Queue (SQ) is re-activated via the mlx5e queue management operations, mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), zeroing the Byte Queue Limits (BQL) counters of channels that still have transmit work queue entries (WQEs) in flight. The next TX completion then over-charges the dynamic queue limits (dql) accounting and trips the BUG_ON() in dql_completed(), causing a kernel panic in IRQ/NAPI context and crashing the system, i.e. a denial of service limited to availability. Triggering the vulnerable transition requires privileged local access to reconfigure or re-activate network queues while transmit traffic is still outstanding; it is not directly reachable through remote network traffic alone, which is why Red Hat Product Security rates this flaw as Low impact despite the Red Hat CVSS:3.1 base score of 5.5 (MODERATE, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced together with the mlx5e queue management operations and single channel swap support, so earlier Red Hat Enterprise Linux streams (RHEL 7, 8, 9.2, 9.4, 9.6 and 10.0) are not affected because the vulnerable code is not present. For the affected streams the fix is currently deferred; the residual risk is that a privileged local action that restarts a network queue while transmissions are in flight can panic the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.