CVE-2026-64210 Linux CVE debrief

Who should care

Linux kernel users, network administrators, and security teams should be aware of this vulnerability and take steps to mitigate it. They should review their system configurations, apply patches or updates, and monitor system logs for error messages related to ICOSQ and napi poll.

Technical summary

The Linux kernel vulnerability CVE-2026-64210 occurs in the net/mlx5e: xsk component. During napi poll, when the affinity changes and there's still XSK work to be done, an ICOSQ interrupt is triggered on the new CPU without proper protection. This can lead to two types of races: one between mlx5e_trigger_irq() and mlx5e_xsk_alloc_rx_mpwqe() running on different CPUs due to affinity changes, and another between mlx5e_trigger_irq() on the ICOSQ and mlx5e_trigger_napi_icosq(). The fix involves kicking the async ICOSQ, which is always locked, instead of directly triggering the ICOSQ interrupt.

Defensive priority

High priority due to potential for system crashes and data corruption.

Recommended defensive actions

• Apply the official patch or update to a fixed Linux kernel version.
• Review and update network configurations to minimize potential impact.
• Monitor system logs for error messages related to ICOSQ and napi poll.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was noticed in the wild with error messages indicating Bad OP in ICOSQ CQE and WARNING in en_rx.c. The provided splat and WQE dump suggest system crashes and data corruption. Linux kernel users should verify their deployments for potential exposure and review system logs for related error messages. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability.

Official resources