CVE-2026-74623

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: free stranded TX buffers on ring deinit

aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()

call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and

stops at hw_head, which no longer moves once aq_vec_stop() has stopped

the hardware and NAPI. Completed descriptors beyond the budget and

everything still posted in [hw_head, sw_tail) keep their skb or

xdp_frame when the interface goes down: aq_vec_ring_free() then frees

the buffer ring and the references are lost for good.

Today this is a silent memory leak on every interface down under

TX/XDP_TX load. With the conversion of the RX path to page_pool posted

for net-next it becomes much more visible: XDP_TX frames carry fragment

references on the RX ring's page_pool, so a single stranded frame keeps

the pool's inflight count above zero forever. page_pool_destroy() then

never completes, the pool is leaked together with its pag

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References