Improper resource shutdown or release in Linux kernel - CVE-2026-74525
Published: August 16, 2026
Vulnerability identifier: #VU143260
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74525
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in init_dma_desc_rings() when handling RX descriptor ring allocation failures. A local user can trigger RX allocation failure during device initialization to cause a denial of service.
The issue results in TX ring resources being leaked when RX ring allocation fails after TX rings were allocated earlier in the same function.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74525
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/3563e2486dcd50a751dbcbc1de37e5186646dce6
- https://git.kernel.org/stable/c/42b87cfd9666ef156637c90ff3f6f6dd9a5ad4cb
- https://git.kernel.org/stable/c/b33644a4f6d8f127c62d7b39f24114d3d2499204
- https://git.kernel.org/stable/c/c870f7e2890b9f78ac84515a9809cc5c183c975e
- https://git.kernel.org/stable/c/f2e5bb9fb710553e76a3be9097b448b4e73d8c92