Strix
57.4K

CVE-2026-74622

Unknown

Last modified

CVE-2026-74622 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free.

Description

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down. Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 1e58b0bab40dcbdfc04acaba6a221d40801c3770; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 30c473ea097ef0c93b064281b3e295c97d17e28b; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 17c99dd86f169c7a3e73d6778e79ef5b1ed3ceac; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < ff451bc4290b79c04f1c5cfa928d448f9d47ecf5; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 64e1346bc66b947eb80b848e4c8d9828ba50e0fe; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 782cc40b7ade4614a8aec0b948b8cf95c69f8d4b; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 24d87dc28ddd3771dd0e88719209811809729439; >= 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < e8e7471ef686b6c002218fee9671cc61992ae01a
LinuxLinux5.2

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-74622?
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down. Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path.
How severe is CVE-2026-74622?
Severity scoring for CVE-2026-74622 is pending analysis.
How do I fix CVE-2026-74622?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-74622?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST