{"id":"CVE-2026-74698","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix BQL reset on SQ re-activation\n\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix BQL reset on SQ re-activation\n\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted. mlx5e_activate_tx…","severity":"none","published":"2026-08-22","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74698","references":[{"url":"https://git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00206,"epssPercentile":0.09926,"ingestedAt":"2026-10-14T13:30:58.541Z","slug":"CVE-2026-74698","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix BQL reset on SQ re-activation\n\nmlx5e_queue_start() deactivates and re-activates all channels but closes\nonly the queue being restarted. mlx5e_activate_txqsq() then\nunconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters\nof channels that kept their in-flight TX WQEs. The next completion then\nover-charges and trips the BUG_ON() in dql_completed():\n\n  kernel BUG at lib/dynamic_queue_limits.c:99!\n  RIP: 0010:dql_completed+0x23d/0x280\n  Call Trace:\n   <IRQ>\n   mlx5e_poll_tx_cq+0x668/0xa60\n   mlx5e_napi_poll+0x5b/0x7b0\n   net_rx_action+0x15a/0x580\n\nReset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).\n\nIn the case that reset is skipped, the outstanding WQEs will eventually\ncomplete and rebalance the dql. The dql->limit is carried across the\nreset.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}