Improper resource shutdown or release in Linux kernel - CVE-2026-74622

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aq_ring_rx_deinit() in the atlantic network driver when deinitializing receive rings. A local user can trigger interface teardown while buffers have been consumed but not yet refilled to cause a denial of service.

The issue occurs because receive buffers in the gap between sw_tail and sw_head can retain live pages and DMA mappings that are not released during ring deinitialization.

Affected software

How to mitigate CVE-2026-74622

External References

• https://git.kernel.org/stable/c/17c99dd86f169c7a3e73d6778e79ef5b1ed3ceac
• https://git.kernel.org/stable/c/1e58b0bab40dcbdfc04acaba6a221d40801c3770
• https://git.kernel.org/stable/c/24d87dc28ddd3771dd0e88719209811809729439
• https://git.kernel.org/stable/c/30c473ea097ef0c93b064281b3e295c97d17e28b
• https://git.kernel.org/stable/c/64e1346bc66b947eb80b848e4c8d9828ba50e0fe
• https://git.kernel.org/stable/c/782cc40b7ade4614a8aec0b948b8cf95c69f8d4b
• https://git.kernel.org/stable/c/e8e7471ef686b6c002218fee9671cc61992ae01a
• https://git.kernel.org/stable/c/ff451bc4290b79c04f1c5cfa928d448f9d47ecf5

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel aquantia atlantic driver
• Debian update for linux