CVE-2026-74622 Overview
CVE-2026-74622 is a memory leak vulnerability in the Linux kernel atlantic network driver. The flaw resides in the aq_ring_rx_deinit() function, which only walks the [sw_head, sw_tail) region of the RX ring during interface teardown. Consumed but not-yet-refilled buffers in the complementary [sw_tail, sw_head) gap retain live pages and DMA mappings that are never released. Every interface down event leaks up to a refill batch worth of pages and DMA mappings. The issue was resolved by walking the entire ring and releasing all remaining buffers, with an additional safeguard for partial aq_ptp_ring_alloc() failure paths.
Critical Impact
Repeated interface down events on Aquantia atlantic network adapters progressively exhaust kernel memory and DMA mappings, potentially leading to resource exhaustion on affected systems.
Affected Products
- Linux kernel atlantic (Aquantia AQtion) network driver
- Multiple stable kernel branches receiving backports (see referenced kernel commits)
- Systems running Aquantia/Marvell AQC-series network interface cards
Discovery Timeline
- 2026-08-22 - CVE-2026-74622 published to the National Vulnerability Database (NVD)
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74622
Vulnerability Analysis
The vulnerability is a memory leak [CWE-401] in the RX ring teardown path of the Linux atlantic driver. When a page reuse strategy was introduced to the driver, cleaned RX buffers began retaining their backing pages and DMA mappings inside the ring for later reuse. Refill operations became batched through aq_ring_rx_fill(), which returns early until AQ_CFG_RX_REFILL_THRES slots become free.
During interface teardown, aq_ring_rx_deinit() iterates only across the range [sw_head, sw_tail), which represents descriptors currently posted to hardware. Buffers already consumed by the driver but not yet reposted sit in the complementary [sw_tail, sw_head) region. The deinit walk never inspects this region, so any pages and DMA mappings retained there persist beyond driver shutdown.
Root Cause
The root cause is an incomplete traversal of the RX ring during deinitialization. The original walk logic predates the page reuse and batched refill optimization. After the optimization landed, valid page references could exist outside the [sw_head, sw_tail) window, but the teardown code was not updated to reflect this. A secondary defect exists on the PTP unwind path: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still executes against a freed structure.
Attack Vector
The vulnerability is triggered by legitimate operations that bring the network interface down. Each interface down cycle leaks up to AQ_CFG_RX_REFILL_THRES pages along with their DMA mappings. Repeated administrative actions such as ifconfig down, link flaps, or driver reloads accumulate leaked resources. Sustained cycling can exhaust DMA-capable memory or IOMMU mapping entries, producing degraded system stability. No remote or unprivileged trigger is described in the upstream commit.
No verified proof-of-concept code is available. The corrective patches are published as kernel commits 17c99dd, 1e58b0b, 24d87dc, 30c473e, 64e1346, 782cc40, e8e7471, and ff451bc4 in the upstream stable tree.
Detection Methods for CVE-2026-74622
Indicators of Compromise
- Progressive decrease in available system memory correlating with atlantic interface down or link-flap events
- Growth in DMA mapping counts visible via /proc/meminfo, /proc/vmallocinfo, or IOMMU statistics without a corresponding workload increase
- Kernel warnings related to page or DMA allocation pressure on hosts using Aquantia AQC-series adapters
Detection Strategies
- Inventory Linux systems running the atlantic driver by inspecting lsmod and ethtool -i <iface> output for the module name
- Correlate ip link state-change events with memory utilization metrics to identify hosts leaking on each interface transition
- Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts
Monitoring Recommendations
- Track MemAvailable, Slab, and DMA-related counters over time on hosts with Aquantia NICs
- Alert on repeated atlantic interface down or driver reload events on production hosts
- Ingest kernel logs into a centralized data lake and query for atlantic, aq_ring, or DMA allocation failure messages
How to Mitigate CVE-2026-74622
Immediate Actions Required
- Identify all Linux hosts using the atlantic driver and record their current kernel versions
- Apply the vendor kernel update containing the upstream fix commits as soon as it becomes available for your distribution
- Avoid unnecessary interface down or driver reload cycles on unpatched hosts until updates are deployed
Patch Information
The fix walks the entire RX ring during deinitialization and releases every remaining buffer, rather than only the [sw_head, sw_tail) region. It also adds an early return when the buffer ring is already gone, safely handling the partial aq_ptp_ring_alloc() failure unwind path. The patch is available in the following upstream commits: Kernel Commit 17c99dd, Kernel Commit 1e58b0b, Kernel Commit 24d87dc, Kernel Commit 30c473e, Kernel Commit 64e1346, Kernel Commit 782cc40, Kernel Commit e8e7471, and Kernel Commit ff451bc4.
Workarounds
- Minimize administrative interface down or atlantic driver reload operations on production hosts until patches are applied
- Schedule periodic reboots on long-running hosts that experience frequent link flaps to reclaim leaked resources
- Where feasible, migrate critical workloads off Aquantia AQC-series NICs on unpatched kernels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
