VulnerabilityPublished 22 Aug 2026Updated 6 Nov 2026

CVE-2026-74622: Linux kernel · net: atlantic: free RX pages of consumed but not refilled buffers

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ff451bc4290b79c04f1c5cfa928d448f9d47ecf5 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:55 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ff451bc4290b79c04f1c5cfa928d448f9d47ecf5, e8e7471ef686b6c002218fee9671cc61992ae01a, 782cc40b7ade4614a8aec0b948b8cf95c69f8d4b +5

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < ff451bc4290b79c04f1c5cfa928d448f9d47ecf5	Fixed in ff451bc4290b79c04f1c5cfa928d448f9d47ecf5
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < e8e7471ef686b6c002218fee9671cc61992ae01a	Fixed in e8e7471ef686b6c002218fee9671cc61992ae01a
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 782cc40b7ade4614a8aec0b948b8cf95c69f8d4b	Fixed in 782cc40b7ade4614a8aec0b948b8cf95c69f8d4b
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 64e1346bc66b947eb80b848e4c8d9828ba50e0fe	Fixed in 64e1346bc66b947eb80b848e4c8d9828ba50e0fe
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 30c473ea097ef0c93b064281b3e295c97d17e28b	Fixed in 30c473ea097ef0c93b064281b3e295c97d17e28b
LinuxLinux	Affected ≥ 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86, < 24d87dc28ddd3771dd0e88719209811809729439	Fixed in 24d87dc28ddd3771dd0e88719209811809729439

AI-suggested

A fix is available and has been applied in the Linux kernel commits identified by the provided fixed version hashes. Users should update to a Linux kernel version that includes these fixes to prevent RX page and DMA mapping leaks. No additional mitigation is indicated.

Description

A vulnerability in the Linux kernel's atlantic network driver causes RX pages and DMA mappings to leak when network interfaces are brought down. This occurs because the driver does not free consumed but not refilled RX buffer pages during deinitialization, leading to resource leakage.

Impact

This vulnerability causes resource leakage of RX pages and DMA mappings on network interface shutdown, which could degrade system performance or stability over time due to unreleased memory and DMA resources. There is no indication of direct code execution or privilege escalation impact.

Summary

The Linux kernel atlantic network driver had a flaw in its RX buffer management. The function aq_ring_rx_deinit() only processed the range of RX buffers posted to hardware, missing consumed but unrefilled buffers that remain in a complementary range. Since the driver batches RX buffer refills, these unrefilled buffers retain their pages and DMA mappings, causing a leak on every interface down event. The fix involves walking the entire RX ring to release all remaining pages and DMA mappings, and adding a safeguard to bail out if the buffer ring is already freed during partial allocation failures.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:55 UTC

Technical details

References

Community reviews

Related threats