Improper resource shutdown or release in Linux kernel - CVE-2026-74623

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the atlantic driver TX ring deinitialization logic when tearing down network interfaces under TX or XDP_TX load. A local user can trigger interface teardown while transmit descriptors remain stranded to cause a denial of service.

Under XDP_TX load, stranded frames can keep the page pool inflight count above zero and prevent pool shutdown, with repeated stall warnings during interface down, XDP detach, or ring resize operations.

Affected software

How to mitigate CVE-2026-74623

External References

• https://git.kernel.org/stable/c/307d80193b4a4a75b8dc4e0d3162be3755abbed7
• https://git.kernel.org/stable/c/3447641d361dcc5511841d986ad4d849b2900d9b
• https://git.kernel.org/stable/c/452636ea5410a96e02ebaaf80b21e3620b98e0dd
• https://git.kernel.org/stable/c/4f1c20873f70b4b22ef86dc38dad1fda8e169bcd
• https://git.kernel.org/stable/c/7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c
• https://git.kernel.org/stable/c/a14ceebd13bf857bfca052bc5a6bd49e737912be
• https://git.kernel.org/stable/c/b13202d401e1a20fec89b0cda733dcbaf279f79d
• https://git.kernel.org/stable/c/dd633280de7fdfd60dc4fcf63d04e2ad95b43269

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel aquantia atlantic driver
• Debian update for linux