Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74622— net: atlantic: free RX pages of consumed but not refilled buffers

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.2版本存在安全漏洞，该漏洞源于aq_ring_rx_deinit()函数只遍历已提交硬件的区域，未释放已消费但未重新填充的缓冲区，导致页面和DMA映射泄漏，可能造成内存泄漏。

AI Predicted 5.5 Difficulty: Easy EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 1e58b0bab40dcbdfc04acaba6a221d40801c3770 affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 30c473ea097ef0c93b064281b3e295c97d17e28b affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 17c99dd86f169c7a3e73d6778e79ef5b1ed3ceac affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< ff451bc4290b79c04f1c5cfa928d448f9d47ecf5 affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 64e1346bc66b947eb80b848e4c8d9828ba50e0fe affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 782cc40b7ade4614a8aec0b948b8cf95c69f8d4b affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< 24d87dc28ddd3771dd0e88719209811809729439 affected
46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86< e8e7471ef686b6c002218fee9671cc61992ae01a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74622

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: atlantic: free RX pages of consumed but not refilled buffers
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down. Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.2版本存在安全漏洞，该漏洞源于aq_ring_rx_deinit()函数只遍历已提交硬件的区域，未释放已消费但未重新填充的缓冲区，导致页面和DMA映射泄漏，可能造成内存泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 46f4c29d9de6e4a9d4ed7de9a37dd42501d89f86 ~ 1e58b0bab40dcbdfc04acaba6a221d40801c3770 -
Linux Linux 5.2 -

II. Public POCs for CVE-2026-74622

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74622

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74622 (8)

Same Patch Batch · Linux · 2026-08-22 · 149 CVEs total

CVE-2026-74705 10.0 CRITICAL udp: fix potential use-after-free in tunnel segmentation
CVE-2026-74612 10.0 CRITICAL veth: fix skb length accounting after XDP frag adjustment
CVE-2026-74688 9.8 CRITICAL sctp: clear control chunk transport if it is being removed
CVE-2026-74669 9.8 CRITICAL ipvs: clear IPv4 options after rebasing tunnel ICMP errors
CVE-2026-74662 9.8 CRITICAL inet: frags: publish queues before arming timer
CVE-2026-74727 9.8 CRITICAL ovpn: skip rehash for peers already removed from by_id
CVE-2026-74628 9.8 CRITICAL net/x25: fix use-after-free of the socket by its timers
CVE-2026-74608 9.8 CRITICAL smb: client: Fix use-after-free in cifs_try_adding_channels()
CVE-2026-74617 9.8 CRITICAL dibs: initialise dibs->lock in dibs_dev_alloc()
CVE-2026-74597 9.8 CRITICAL ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
CVE-2026-74616 9.8 CRITICAL xdp: reject clones that overrun skb_shared_info tailroom
CVE-2026-74723 9.8 CRITICAL btrfs: lzo: reject inline extents without valid headers
CVE-2026-74730 9.8 CRITICAL NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
CVE-2026-74611 9.8 CRITICAL tls: rx: restore msg_iter before TLS 1.3 optimistic retry
CVE-2026-74586 9.8 CRITICAL sctp: clear new_transport when removing a peer
CVE-2026-74591 9.8 CRITICAL mm/filemap: __filemap_add_folio() restore index before retrying
CVE-2026-74587 9.8 CRITICAL sctp: fix use-after-free of cached ASCONF chunk
CVE-2026-74588 9.8 CRITICAL sctp: keep chunk->transport in step with the list it is queued on
CVE-2026-74712 9.3 CRITICAL vdpa/mlx5: Fix buffer length in create_direct_keys()
CVE-2026-74665 9.1 CRITICAL net: fix skb length accounting after generic XDP frag adjustment

Showing top 20 of 149 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74622

No comments yet

Leave a comment