CVE-2026-52983: Linux Airoha Driver BQL Accounting Imbalance – Network Performance Risk

Technical summary

CVE-2026-52983 describes a Bandwidth Queue Limit (BQL) accounting imbalance in the Airoha driver's TX path. The airoha_dev_xmit() function computes a queue index using modulo arithmetic against AIROHA_NUM_TX_RING, then accounts inflight packets only for that subset of netdev TX queues. Conversely, airoha_qdma_tx_napi_poll() reports completions across all num_tx_queues, violating the BQL accounting invariant that inflight packets must be tracked symmetrically. The fix ensures consistent BQL state and adds proper TX queue reset in the ndo_stop callback.

Business impact

Systems relying on Airoha network interfaces may experience unpredictable network latency, packet scheduling anomalies, or DMA queue stalls under sustained high-throughput conditions. Affected deployments—particularly those running bandwidth-intensive workloads or edge computing platforms using Airoha silicon—risk degraded application performance and potential service availability issues. The impact is confined to packet transmission quality and scheduling; no data confidentiality or integrity loss occurs.

Affected systems

Linux kernel versions prior to the patch release, specifically systems equipped with Airoha network interface hardware and running affected kernel versions. Typical use cases include networking appliances, routers, and edge computing platforms that integrate Airoha PHY/MAC silicon. The scope is narrow but critical for affected device categories.

Exploitability

Exploitation requires no authentication, user interaction, or network-based triggering; however, practical impact manifests only under specific conditions: sustained high-throughput transmission workloads that trigger TX queue completion polling. Passive remote exploitation is not feasible. This is a quality/stability issue rather than a direct security vulnerability, though its effects on network reliability carry operational risk. No active exploit development is typically required to observe the issue—normal heavy TX load will trigger the BQL imbalance.

Remediation

Update the Linux kernel to a version incorporating the BQL accounting fix. Verify with your Linux distribution and hardware vendor for the specific kernel version or patch series that resolves this issue. For deployments unable to update immediately, monitor network performance metrics (BQL state, TX queue depth, latency variance) and consider traffic shaping to reduce TX queue strain until patches are deployed.

Patch guidance

Consult your Linux distribution's security advisory for the patch release date and version number specific to your kernel series (e.g., stable, LTS). Airoha hardware vendors (MediaTek, etc.) may also publish driver updates; verify against the vendor advisory whether a standalone driver patch is available prior to full kernel upgrade. Test in a non-production environment to confirm TX performance stabilization post-patch.

Detection guidance

Monitor kernel logs for TX scheduling anomalies, BQL warnings, or NAPI poll timeout events on Airoha interfaces. Use ethtool statistics to observe inconsistencies in TX queue depth, completion counts, or BQL state across queues. Compare netdev TX completions reported by airoha_qdma_tx_napi_poll() against inflight packet counts to identify the accounting gap. Sustained high throughput followed by latency spikes or packet drops is a telltale sign of BQL imbalance impact.

Why prioritize this

This CVE earns a HIGH CVSS score (7.5) due to its availability impact (denial of service via performance degradation) combined with low attack complexity and no authentication requirement. While the practical trigger requires specific TX load conditions, the asymmetry in BQL accounting means the issue will eventually manifest in production high-throughput scenarios. Organizations running Airoha-based network hardware under sustained load should prioritize kernel patching to avoid unpredictable performance incidents.

Risk score, explained

CVSS 3.1 score of 7.5 reflects an availability impact (A:H) that requires no authentication (PR:N), no user interaction (UI:N), and network-accessible scope (AV:N) with low complexity (AC:L). The HIGH severity classification appropriately captures the operational risk of network performance degradation on affected systems. The score does not account for scope limitation to Airoha-equipped devices; organizations without such hardware face zero risk.

Frequently asked questions