---
id: CVE-2026-74698
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: fix BQL reset on SQ re-activation

  mlx5e_queue_start() deactivates and re-activates all channels but closes
  only the queue being restarted
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: fix BQL reset on SQ re-activation

  mlx5e_queue_start() deactivates and re-activates all channels but closes
  only the queue being restarted. mlx5e_activate_tx…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74698'
references:
  - url: 'https://git.kernel.org/stable/c/88664c48d7d1eca8e1ac92da85c89c26af741cf1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d2897717cd222e575599d903d885c48602699800'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7386770be1bf810bcd6af39d1e4bfeab3408430'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00206
epssPercentile: 0.09926
ingestedAt: '2026-10-14T13:30:58.541Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix BQL reset on SQ re-activation

mlx5e_queue_start() deactivates and re-activates all channels but closes
only the queue being restarted. mlx5e_activate_txqsq() then
unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters
of channels that kept their in-flight TX WQEs. The next completion then
over-charges and trips the BUG_ON() in dql_completed():

  kernel BUG at lib/dynamic_queue_limits.c:99!
  RIP: 0010:dql_completed+0x23d/0x280
  Call Trace:
   <IRQ>
   mlx5e_poll_tx_cq+0x668/0xa60
   mlx5e_napi_poll+0x5b/0x7b0
   net_rx_action+0x15a/0x580

Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).

In the case that reset is skipped, the outstanding WQEs will eventually
complete and rebalance the dql. The dql->limit is carried across the
reset.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.