CVE-2026-74623

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the atlantic driver during ring deinitialization. The aq vec deinit() function drains TX rings using a single aq ring tx clean() call, which is limited by the AQ CFG TX CLEAN BUDGET (256 descriptors) and stops at hw head. When the interface goes down, descriptors beyond this budget and those posted in the range [hw head, sw tail) retain their skb or xdp frame references. Subsequently, aq vec ring free() frees the buffer ring, causing these references to be lost. This issue is exacerbated by the RX path conversion to page pool, where stranded XDP TX frames keep the pool's inflight count above zero, preventing page pool destroy() from completing and triggering repeated warnings from page pool release retry() during interface shutdown, XDP detachment, or ring resizing under XDP TX load.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.