High 7.5Published Jun 24, 2026

CVE-2026-52983net: airoha: fix BQL imbalance in TX path

Updated under an hour ago (Oct 27, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix BQL imbalance in TX path Fix a possible BQL imbalance in airoha_dev_xmit(), where inflight packets are accounted only for the AIROHA_NUM_TX_RING netdev TX queues. The queue index is computed as: qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx) txq = netdev_get_tx_queue(dev, qid); However, airoha_qdma_tx_napi_poll() accounts completions across all netdev TX queues (num_tx_queues), leading to inconsistent BQL accounting. Also reset all netdev TX queues in the ndo_stop callback.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ca24fcac1daaa5e8a667981d81986a3eb4b9fb04 before fcd6a3bb48bb661876c2743e89f0a6567f5cea2c; from 1d304174106c93ce05f6088813ad7203b3eb381a before aaad53a55812acd2355c0e5478896381e78b0110; from 1d304174106c93ce05f6088813ad7203b3eb381a before ded2694247a55a16d0ebbe2d6f9139305c21457a; from 1d304174106c93ce05f6088813ad7203b3eb381a before 2d9f5a118205da2683ffcec78b9347f1f01a820e; from 6.12.91 before 6.12.114	CNA record
linux linux_kernel linux:linux_kernel	from 6.12.91 before 6.18.33; from 6.19 before 7.0.10; 7.1	NVD

References

References

https://git.kernel.org/stable/c/fcd6a3bb48bb661876c2743e89f0a6567f5cea2c
https://git.kernel.org/stable/c/aaad53a55812acd2355c0e5478896381e78b0110	patch
https://git.kernel.org/stable/c/ded2694247a55a16d0ebbe2d6f9139305c21457a	patch
https://git.kernel.org/stable/c/2d9f5a118205da2683ffcec78b9347f1f01a820e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.