LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated. work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21) These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux driver flaw can stall network transmit processing on systems using supported OcteonTX2 hardware. Under concurrent traffic, affected hardware queues may deadlock or lose credits, disrupting availability. The issue does not affect confidentiality or integrity, and ordinary Linux systems without this hardware and driver are unlikely to be exposed.

Executive priority

Prioritize affected network appliances and infrastructure, especially systems supporting critical connectivity. Treat this as a high availability risk rather than a data-theft issue. Rapid action is warranted where OcteonTX2 hardware is confirmed; other Linux estates can first verify hardware and driver presence.

Technical view

The octeontx2-af NIX queue manager can lose forward progress when multiple send queues share an SMQ. Sticky operation, sticky-to-non-sticky transitions, and clock gating can trigger SQM/PSE stalls or credit loss. The kernel fix changes NIX_AF_SQM_DBG_CTL_STATUS settings to disable problematic sticky behavior and keep the control-flow clock enabled.

Likely exposure

Exposure is limited to Linux systems using the octeontx2-af driver with relevant OcteonTX2 networking hardware. Risk is greatest under concurrent transmission through multiple send queues sharing an SMQ. The supplied affected-version data is ambiguous, so kernel version alone should not determine exposure.

Exploitation context

The CVSS 3.1 score is 7.5, reflecting network-reachable availability impact without authentication or user interaction. However, the bundle reports no KEV listing and provides no evidence of active exploitation or a public exploit. The documented trigger is concurrent transmit activity interacting with hardware errata.

Researcher notes

The remediation addresses hardware errata through register configuration, sacrificing sticky optimizations to preserve progress. No CWE is supplied. The affected-version list mixes a starting version, branch-specific endpoints, and repeated commit identifiers without explicit range relationships; validate fixes using vendor package metadata and the referenced stable commits.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
  • Confirm appliance or distribution advisories before relying on kernel version numbers alone.
  • Prioritize traffic-critical OcteonTX2 systems where network stalls would cause material disruption.
  • Use operational traffic controls to reduce concurrent queue pressure until patching, if vendor-supported.

Validation and detection

  • Inventory systems for OcteonTX2 hardware and the octeontx2-af driver.
  • Map each running kernel to its distribution build and backported fixes.
  • Verify inclusion of the applicable referenced stable commit through vendor changelogs or package metadata.
  • Review monitoring for transmit stalls, queue deadlocks, credit loss, or unexplained network outages.
  • After updating, test concurrent transmit workloads and confirm sustained queue progress.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43296 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43296Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156, 5d9b976d4480dc0dcfa3719b645636d2f0f9f156unaffected
LinuxLinux5.5, 0, 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.