CVE-2026-74623

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74623", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.921Z", "datePublished": "2026-08-22T15:32:06.467Z", "dateUpdated": "2026-11-06T17:05:49.354Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:48.573Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: free stranded TX buffers on ring deinit\n\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()\ncall, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and\nstops at hw_head, which no longer moves once aq_vec_stop() has stopped\nthe hardware and NAPI. Completed descriptors beyond the budget and\neverything still posted in [hw_head, sw_tail) keep their skb or\nxdp_frame when the interface goes down: aq_vec_ring_free() then frees\nthe buffer ring and the references are lost for good.\n\nToday this is a silent memory leak on every interface down under\nTX/XDP_TX load. With the conversion of the RX path to page_pool posted\nfor net-next it becomes much more visible: XDP_TX frames carry fragment\nreferences on the RX ring's page_pool, so a single stranded frame keeps\nthe pool's inflight count above zero forever. page_pool_destroy() then\nnever completes, the pool is leaked together with its pages, and\n\"page_pool_release_retry() stalled pool shutdown\" is warned every 60\nseconds from that point on, on every ifdown, XDP detach or ring resize\nunder XDP_TX load.\n\nBring back aq_ring_tx_deinit() as it was before the removal and use it\nfor teardown again, with one extension: TX rings can hold xdp_frames\nnowadays, so release those too. They are returned with\nxdp_return_frame() since this runs in process context."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "versions": [{"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "a14ceebd13bf857bfca052bc5a6bd49e737912be", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "4f1c20873f70b4b22ef86dc38dad1fda8e169bcd", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "307d80193b4a4a75b8dc4e0d3162be3755abbed7", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "3447641d361dcc5511841d986ad4d849b2900d9b", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "b13202d401e1a20fec89b0cda733dcbaf279f79d", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "dd633280de7fdfd60dc4fcf63d04e2ad95b43269", "status": "affected", "versionType": "git"}, {"version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "452636ea5410a96e02ebaaf80b21e3620b98e0dd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a14ceebd13bf857bfca052bc5a6bd49e737912be"}, {"url": "https://git.kernel.org/stable/c/4f1c20873f70b4b22ef86dc38dad1fda8e169bcd"}, {"url": "https://git.kernel.org/stable/c/307d80193b4a4a75b8dc4e0d3162be3755abbed7"}, {"url": "https://git.kernel.org/stable/c/7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c"}, {"url": "https://git.kernel.org/stable/c/3447641d361dcc5511841d986ad4d849b2900d9b"}, {"url": "https://git.kernel.org/stable/c/b13202d401e1a20fec89b0cda733dcbaf279f79d"}, {"url": "https://git.kernel.org/stable/c/dd633280de7fdfd60dc4fcf63d04e2ad95b43269"}, {"url": "https://git.kernel.org/stable/c/452636ea5410a96e02ebaaf80b21e3620b98e0dd"}], "title": "net: atlantic: free stranded TX buffers on ring deinit", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74623", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:13.192542Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:49.354Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74623", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:13.192542Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:00:14.194Z"}}], "cna": {"title": "net: atlantic: free stranded TX buffers on ring deinit", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "a14ceebd13bf857bfca052bc5a6bd49e737912be", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "4f1c20873f70b4b22ef86dc38dad1fda8e169bcd", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "307d80193b4a4a75b8dc4e0d3162be3755abbed7", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "3447641d361dcc5511841d986ad4d849b2900d9b", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "b13202d401e1a20fec89b0cda733dcbaf279f79d", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "dd633280de7fdfd60dc4fcf63d04e2ad95b43269", "versionType": "git"}, {"status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "lessThan": "452636ea5410a96e02ebaaf80b21e3620b98e0dd", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a14ceebd13bf857bfca052bc5a6bd49e737912be"}, {"url": "https://git.kernel.org/stable/c/4f1c20873f70b4b22ef86dc38dad1fda8e169bcd"}, {"url": "https://git.kernel.org/stable/c/307d80193b4a4a75b8dc4e0d3162be3755abbed7"}, {"url": "https://git.kernel.org/stable/c/7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c"}, {"url": "https://git.kernel.org/stable/c/3447641d361dcc5511841d986ad4d849b2900d9b"}, {"url": "https://git.kernel.org/stable/c/b13202d401e1a20fec89b0cda733dcbaf279f79d"}, {"url": "https://git.kernel.org/stable/c/dd633280de7fdfd60dc4fcf63d04e2ad95b43269"}, {"url": "https://git.kernel.org/stable/c/452636ea5410a96e02ebaaf80b21e3620b98e0dd"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: free stranded TX buffers on ring deinit\n\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()\ncall, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and\nstops at hw_head, which no longer moves once aq_vec_stop() has stopped\nthe hardware and NAPI. Completed descriptors beyond the budget and\neverything still posted in [hw_head, sw_tail) keep their skb or\nxdp_frame when the interface goes down: aq_vec_ring_free() then frees\nthe buffer ring and the references are lost for good.\n\nToday this is a silent memory leak on every interface down under\nTX/XDP_TX load. With the conversion of the RX path to page_pool posted\nfor net-next it becomes much more visible: XDP_TX frames carry fragment\nreferences on the RX ring's page_pool, so a single stranded frame keeps\nthe pool's inflight count above zero forever. page_pool_destroy() then\nnever completes, the pool is leaked together with its pages, and\n\"page_pool_release_retry() stalled pool shutdown\" is warned every 60\nseconds from that point on, on every ifdown, XDP detach or ring resize\nunder XDP_TX load.\n\nBring back aq_ring_tx_deinit() as it was before the removal and use it\nfor teardown again, with one extension: TX rings can hold xdp_frames\nnowadays, so release those too. They are returned with\nxdp_return_frame() since this runs in process context."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:48.573Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74623", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:49.354Z", "dateReserved": "2026-08-15T05:44:03.921Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:06.467Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a14ceebd13bf857bfca052bc5a6bd49e737912be", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "4f1c20873f70b4b22ef86dc38dad1fda8e169bcd", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "307d80193b4a4a75b8dc4e0d3162be3755abbed7", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "3447641d361dcc5511841d986ad4d849b2900d9b", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "b13202d401e1a20fec89b0cda733dcbaf279f79d", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "dd633280de7fdfd60dc4fcf63d04e2ad95b43269", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}, {"lessThan": "452636ea5410a96e02ebaaf80b21e3620b98e0dd", "status": "affected", "version": "eb36bedf28be6d986bdbcfa375bab08ffa45efd8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/aquantia/atlantic/aq_ring.c", "drivers/net/ethernet/aquantia/atlantic/aq_ring.h", "drivers/net/ethernet/aquantia/atlantic/aq_vec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: free stranded TX buffers on ring deinit\n\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()\ncall, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and\nstops at hw_head, which no longer moves once aq_vec_stop() has stopped\nthe hardware and NAPI. Completed descriptors beyond the budget and\neverything still posted in [hw_head, sw_tail) keep their skb or\nxdp_frame when the interface goes down: aq_vec_ring_free() then frees\nthe buffer ring and the references are lost for good.\n\nToday this is a silent memory leak on every interface down under\nTX/XDP_TX load. With the conversion of the RX path to page_pool posted\nfor net-next it becomes much more visible: XDP_TX frames carry fragment\nreferences on the RX ring's page_pool, so a single stranded frame keeps\nthe pool's inflight count above zero forever. page_pool_destroy() then\nnever completes, the pool is leaked together with its pages, and\n\"page_pool_release_retry() stalled pool shutdown\" is warned every 60\nseconds from that point on, on every ifdown, XDP detach or ring resize\nunder XDP_TX load.\n\nBring back aq_ring_tx_deinit() as it was before the removal and use it\nfor teardown again, with one extension: TX rings can hold xdp_frames\nnowadays, so release those too. They are returned with\nxdp_return_frame() since this runs in process context."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: atlantic: liberar b\u00faferes TX varados en la desinicializaci\u00f3n del anillo\n\naq_vec_deinit() vac\u00eda los anillos TX con una \u00fanica llamada a aq_ring_tx_clean(), que libera como m\u00e1ximo AQ_CFG_TX_CLEAN_BUDGET (256) descriptores y se detiene en hw_head, que ya no se mueve una vez que aq_vec_stop() ha detenido el hardware y NAPI. Los descriptores completados m\u00e1s all\u00e1 del presupuesto y todo lo que a\u00fan est\u00e1 publicado en [hw_head, sw_tail) conservan su skb o xdp_frame cuando la interfaz se desactiva: aq_vec_ring_free() luego libera el anillo de b\u00faferes y las referencias se pierden para siempre.\n\nHoy esto es una fuga de memoria silenciosa en cada desactivaci\u00f3n de interfaz bajo carga de TX/XDP_TX. Con la conversi\u00f3n de la ruta RX a page_pool publicada para net-next se vuelve mucho m\u00e1s visible: los frames XDP_TX llevan referencias de fragmentos en el page_pool del anillo RX, por lo que un \u00fanico frame varado mantiene el contador 'inflight' del pool por encima de cero para siempre. page_pool_destroy() entonces nunca se completa, el pool se fuga junto con sus p\u00e1ginas, y se advierte 'page_pool_release_retry() stalled pool shutdown' cada 60 segundos a partir de ese momento, en cada ifdown, desvinculaci\u00f3n de XDP o redimensionamiento de anillo bajo carga de XDP_TX.\n\nRecuperar aq_ring_tx_deinit() como estaba antes de su eliminaci\u00f3n y usarlo para el desmantelamiento de nuevo, con una extensi\u00f3n: los anillos TX pueden contener xdp_frames hoy en d\u00eda, as\u00ed que liberar esos tambi\u00e9n. Se devuelven con xdp_return_frame() ya que esto se ejecuta en contexto de proceso."}], "id": "CVE-2026-74623", "lastModified": "2026-11-06T17:19:52.000", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74623", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:00:13.192542Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:35.157", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/307d80193b4a4a75b8dc4e0d3162be3755abbed7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3447641d361dcc5511841d986ad4d849b2900d9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/452636ea5410a96e02ebaaf80b21e3620b98e0dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f1c20873f70b4b22ef86dc38dad1fda8e169bcd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a14ceebd13bf857bfca052bc5a6bd49e737912be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b13202d401e1a20fec89b0cda733dcbaf279f79d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd633280de7fdfd60dc4fcf63d04e2ad95b43269"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: atlantic: free stranded TX buffers on ring deinit", "id": "2521476", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521476"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-771", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: atlantic: free stranded TX buffers on ring deinit\naq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()\ncall, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and\nstops at hw_head, which no longer moves once aq_vec_stop() has stopped\nthe hardware and NAPI. Completed descriptors beyond the budget and\neverything still posted in [hw_head, sw_tail) keep their skb or\nxdp_frame when the interface goes down: aq_vec_ring_free() then frees\nthe buffer ring and the references are lost for good.\nToday this is a silent memory leak on every interface down under\nTX/XDP_TX load. With the conversion of the RX path to page_pool posted\nfor net-next it becomes much more visible: XDP_TX frames carry fragment\nreferences on the RX ring's page_pool, so a single stranded frame keeps\nthe pool's inflight count above zero forever. page_pool_destroy() then\nnever completes, the pool is leaked together with its pages, and\n\"page_pool_release_retry() stalled pool shutdown\" is warned every 60\nseconds from that point on, on every ifdown, XDP detach or ring resize\nunder XDP_TX load.\nBring back aq_ring_tx_deinit() as it was before the removal and use it\nfor teardown again, with one extension: TX rings can hold xdp_frames\nnowadays, so release those too. They are returned with\nxdp_return_frame() since this runs in process context.", "A flaw was found in the Linux kernel's atlantic network driver. When a network interface using this driver is deinitialized while under transmit (TX) or XDP_TX load, certain transmit buffers are not properly released. This oversight leads to a memory leak, which can prevent the proper shutdown of memory pools and result in continuous system warnings. The cumulative effect of these leaks can lead to resource exhaustion and impact system stability."], "name": "CVE-2026-74623", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74623\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74623\nhttps://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74623-32eb@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,307d80193b4a4a75b8dc4e0d3162be3755abbed7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,3447641d361dcc5511841d986ad4d849b2900d9b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,b13202d401e1a20fec89b0cda733dcbaf279f79d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,dd633280de7fdfd60dc4fcf63d04e2ad95b43269)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb36bedf28be6d986bdbcfa375bab08ffa45efd8,452636ea5410a96e02ebaaf80b21e3620b98e0dd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:45:03.758835+00:00", "updated": "2026-08-25T21:30:06.893753+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}