CVE-2026-74623 Overview
CVE-2026-74623 is a memory leak vulnerability in the Linux kernel's atlantic network driver (aQuantia AQC-series NICs). The flaw resides in the transmit ring deinitialization path, where aq_vec_deinit() drains TX rings with a single aq_ring_tx_clean() call. That call frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer advances after hardware and NAPI have been stopped. Any sk_buff or xdp_frame still posted beyond the budget or in the [hw_head, sw_tail) window is leaked when the interface goes down.
Critical Impact
Under sustained TX or XDP_TX load, every interface down, XDP detach, or ring resize strands buffer references, permanently pinning page_pool pages and producing recurring page_pool_release_retry() stalled pool shutdown warnings.
Affected Products
- Linux kernel atlantic (aQuantia AQC-series 10GbE) network driver
- Multiple stable kernel branches referenced by the upstream fix commits
- Systems running XDP_TX workloads on atlantic NICs
Discovery Timeline
- 2026-08-22 - CVE-2026-74623 published to NVD
- 2026-08-23 - Last updated in NVD database
Technical Details for CVE-2026-74623
Vulnerability Analysis
The atlantic driver tears down each transmit vector by invoking aq_vec_deinit(), which internally calls aq_ring_tx_clean() exactly once. That helper is bounded by AQ_CFG_TX_CLEAN_BUDGET, capped at 256 descriptors per invocation. It also stops advancing when it reaches hw_head, the hardware's completed-descriptor pointer.
Once aq_vec_stop() has quiesced hardware and NAPI, hw_head becomes static. Descriptors that were completed beyond the 256-descriptor budget, and every descriptor still posted between hw_head and sw_tail, retain their attached sk_buff or xdp_frame reference. aq_vec_ring_free() then frees the ring memory itself, orphaning those references without releasing them.
The leak is silent under classic TX workloads. When the RX path is converted to page_pool and XDP_TX is active, each stranded frame keeps a fragment reference on the RX ring's page_pool. This holds the pool's inflight counter above zero forever, so page_pool_destroy() never completes. The kernel emits page_pool_release_retry() stalled pool shutdown every 60 seconds.
Root Cause
The root cause is incomplete resource cleanup during ring deinitialization. aq_ring_tx_clean() was designed for NAPI-context draining under budget, not for teardown. Using it as the sole teardown mechanism leaves descriptors outside the completed window unreleased. The previous aq_ring_tx_deinit() helper, which unconditionally released all posted buffers, had been removed.
Attack Vector
This is not a remotely triggerable vulnerability. Impact is limited to local resource exhaustion. A privileged local user, or automated management tooling that repeatedly toggles the interface, detaches XDP programs, or resizes rings while TX or XDP_TX traffic is in flight, can accumulate leaked pages and kernel objects. Long-running systems eventually exhibit memory pressure and continuous kernel log noise.
The upstream fix reinstates aq_ring_tx_deinit() and calls it from the teardown path. The helper releases both sk_buff and xdp_frame references, returning the latter via xdp_return_frame() since teardown runs in process context.
Detection Methods for CVE-2026-74623
Indicators of Compromise
- Recurring kernel log entries containing page_pool_release_retry() stalled pool shutdown, emitted approximately every 60 seconds
- Steady growth of kernel memory attributed to page_pool pages that outlives interface up/down cycles
- Elevated MemAvailable decline correlated with ifdown, XDP detach, or ethtool -G ring-resize events on atlantic NICs
Detection Strategies
- Monitor dmesg and syslog for the page_pool_release_retry warning string on hosts running atlantic hardware
- Track /proc/meminfo and slab counters across interface state transitions to catch non-returning allocations
- Correlate XDP program attach/detach and link-state events with kernel memory growth over time
Monitoring Recommendations
- Ingest kernel logs from Linux hosts with aQuantia NICs into a centralized logging or SIEM platform and alert on the stalled-pool-shutdown signature
- Baseline page_pool inflight metrics on XDP-enabled hosts and alert on non-decreasing trends after teardown events
- Include uname -r inventory in asset data so unpatched kernel versions on atlantic hosts are visible to vulnerability management
How to Mitigate CVE-2026-74623
Immediate Actions Required
- Identify Linux hosts using the atlantic driver by checking lspci -k and ethtool -i <iface> output for driver name atlantic
- Apply the upstream stable kernel updates that reintroduce aq_ring_tx_deinit() for TX ring teardown
- Reboot affected systems after patching to clear any already-leaked page_pool pages held by the running kernel
Patch Information
The fix is distributed as a series of stable-tree backports referenced in the NVD entry. Review the upstream commits: Linux Kernel Commit 307d801, Linux Kernel Commit 3447641, Linux Kernel Commit 452636e, Linux Kernel Commit 4f1c208, Linux Kernel Commit 7a3e148, Linux Kernel Commit a14ceeb, Linux Kernel Commit b13202d, and Linux Kernel Commit dd63328. Deploy the kernel package from your distribution that incorporates the corresponding backport.
Workarounds
- Avoid repeated interface down, XDP program detach, or ring-resize operations on atlantic NICs while TX or XDP_TX traffic is active
- Where XDP_TX is not required, disable XDP on atlantic interfaces to reduce the amplification effect on page_pool inflight accounting
- Restart affected hosts on a scheduled cadence to reclaim leaked pages until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
