Skip to main content

Linux Kernel CVE-2026-52983

| EUVDEUVD-2026-38851 HIGH
2026-06-24 Linux GHSA-mvhp-248j-7g76
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
2.5 LOW

Bug triggers on-device via specific queue-mapping conditions (AV:L/AC:H), needs local operational access to drive traffic (PR:L), and yields transient TX-stall availability loss only (A:L, C/I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:41 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: fix BQL imbalance in TX path

Fix a possible BQL imbalance in airoha_dev_xmit(), where inflight packets are accounted only for the AIROHA_NUM_TX_RING netdev TX queues. The queue index is computed as:

qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx) txq = netdev_get_tx_queue(dev, qid);

However, airoha_qdma_tx_napi_poll() accounts completions across all netdev TX queues (num_tx_queues), leading to inconsistent BQL accounting.

Also reset all netdev TX queues in the ndo_stop callback.

AnalysisAI

Denial-of-service (TX queue stall) in the Linux kernel's Airoha QDMA Ethernet driver affects systems running on Airoha/MediaTek SoCs where airoha_dev_xmit() accounts inflight packets only across AIROHA_NUM_TX_RING queues while the NAPI completion path settles all netdev TX queues, corrupting Byte Queue Limits (BQL) state. The mismatch can wedge transmit queues and degrade or halt network throughput on the device. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; an upstream stable fix exists.

Technical ContextAI

The affected component is the in-tree airoha_eth network driver for Airoha (MediaTek-derived) SoC Ethernet/QDMA hardware. Byte Queue Limits (BQL) is a Linux networking mechanism that tracks bytes in flight per netdev TX queue to bound buffer bloat; it relies on symmetric accounting - every byte counted as enqueued must later be counted as completed against the same queue. Here airoha_dev_xmit() maps packets onto a limited set of hardware rings (qid = queue_mapping % ARRAY_SIZE(qdma->q_tx)), so enqueue accounting touches only AIROHA_NUM_TX_RING queues, whereas airoha_qdma_tx_napi_poll() reports completions across all dev->num_tx_queues netdev queues. This asymmetry corrupts BQL's in-flight counters. The root-cause class is incorrect calculation / inconsistent resource accounting (closest CWE-682 Incorrect Calculation; CWE field is N/A in source data).

RemediationAI

Upstream fix available (commits, not a single vendor release tag): apply the stable kernel update containing commits aaad53a55812acd2355c0e5478896381e78b0110, 2d9f5a118205da2683ffcec78b9347f1f01a820e, or ded2694247a55a16d0ebbe2d6f9139305c21457a (https://git.kernel.org/stable/c/aaad53a55812acd2355c0e5478896381e78b0110, https://git.kernel.org/stable/c/2d9f5a118205da2683ffcec78b9347f1f01a820e, https://git.kernel.org/stable/c/ded2694247a55a16d0ebbe2d6f9139305c21457a); per the source feed this corresponds to stable releases such as 6.18.33/7.0.10/7.1 - confirm the exact tag for your tree before deploying. Update the kernel to the patched stable release for your distribution. As this is a hardware-specific driver bug with no configuration toggle, there is no clean runtime workaround; if a transmit stall is observed before patching, administratively bouncing the interface (ifconfig down/up or restarting the link, which triggers the ndo_stop reset of all TX queues that this patch also corrects) can temporarily clear the wedged BQL state at the cost of a brief network interruption. Systems not using Airoha SoC Ethernet are not affected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52983 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy