CVE-2026-43296 octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
A hardware errata workaround in the Linux kernel prevents network stalls and deadlocks in the OcteonTX2 AF driver, ensuring system stability under load.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43296?
CVE-2026-43296 is a high-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated.
work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21)
These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations.
Weakness: CWE-667
Which versions are affected by CVE-2026-43296?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43296?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43296 being exploited?
There is no known exploitation of CVE-2026-43296 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43296, DEBIAN-CVE-2026-43296, GHSA-7rmq-9hg9-v4q5, ROOT-OS-DEBIAN-11-CVE-2026-43296, ROOT-OS-UBUNTU-2204-CVE-2026-43296, ROOT-OS-UBUNTU-2404-CVE-2026-43296 and 1 more.