The Linux kernel vulnerability CVE-2026-74622 involves the atlantic network driver where the function aq_ring_rx_deinit() only cleaned a subset of RX buffers ([sw_head, sw_tail)) that were posted to hardware. Due to a page reuse strategy and batched refill mechanism, consumed but not yet reposted buffers remained in the complementary ring region ([sw_tail, sw_head)) with live pages and DMA mappings. These were never freed during deinitialization, causing memory and DMA mapping leaks on interface shutdown. The fix ensures the entire ring is walked and all pages are freed, also adding checks for partial ring allocation failures.

This vulnerability causes a memory leak and DMA mapping leak on every network interface down event in affected Linux kernel versions. While it does not directly enable code execution or data corruption, the leak could degrade system performance or stability over time, especially on systems with frequent interface resets or reinitializations.

A fix has been implemented in the Linux kernel to address this issue by improving the cleanup logic in the atlantic driver. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.