CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers
In the Linux kernel, the following vulnerability has been resolved:
net: atlantic: free RX pages of consumed but not refilled buffers
aqringrxdeinit() only walks [swhead, swtail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aqringrxfill() returns early until AQCFGRXREFILLTHRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [swtail, swhead) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down.
Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aqptpringalloc() failure frees the ring but leaves aqnic set, so aqptpringdeinit() still gets here on the unwind path.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the resource leak?
Systems using the Linux kernel Atlantic network driver are exposed when RX buffers are consumed but not yet reposted at interface teardown. The issue can leak up to a refill batch of RX pages and DMA mappings each time the affected interface is brought down.
Does exploitation require an external attacker?
The provided information describes a lifecycle cleanup flaw during interface shutdown rather than an attacker-controlled code-execution path. It does not specify any remote or local attacker prerequisites.
What happens if the driver is repeatedly brought down before the fix is applied?
Each interface-down event can leak pages and DMA mappings for consumed RX buffers that have not yet been refilled. Repeated interface cycling can therefore accumulate unreleased resources.
Is there an additional failure-path condition addressed by the fix?
Yes. The fix also handles a partial aq_ptp_ring_alloc() failure, where the buffer ring has already been freed but aq_nic remains set and aq_ptp_ring_deinit() is invoked during unwind.