CVE-2026-74285

Received Received - Intake

Memory Provider Leak in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA mappings before stopping the physical queue: __netif_mp_uninstall_rxq(virt_rxq, p); /* DMA unmap */ __netif_mp_close_rxq(phys_rxq->dev, rxq_idx, p); /* queue stop */ This inverts the ordering used by the regular teardown paths (normal device unregister and the io_uring zcrx close path), which stop the queue before revoking the provider's mappings. With the physical queue still live, its NAPI can keep consuming net_iov entries from the page_pool alloc cache after the __netif_mp_uninstall_rxq() has already cleared their dma_addr, opening a window for the device to DMA to a stale or zero address. Fix it by swapping the two calls so the queue is stopped (and its NAPI quiesced) before the provider is uninstalled. No functional regression was observed across repeated runs of the nk_qlease.py HW selftest, which exercises the lease teardown path; this was tested against fbnic QEMU emulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74285

EUVD

EUVD-2026-59432

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the cleanup process for a network receive queue (rxq) incorrectly reverses the order of operations. It uninstalls the memory provider's DMA mappings before stopping the physical queue, which can lead to the queue still processing data with invalid memory addresses.

Detection Guidance

This vulnerability is specific to the Linux kernel's netif_rxq_cleanup_unlease() function and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. No direct commands are provided in the context to detect this issue.

Impact Analysis

This could allow a device to perform DMA operations to invalid or stale memory addresses, potentially causing system crashes, data corruption, or privilege escalation if exploited by a malicious actor.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory management and DMA operations. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the Linux kernel patch that fixes the issue by stopping the physical RX queue before uninstalling its memory provider. Monitor for kernel updates from your distribution and update to a patched version as soon as possible.

Hi! I’m here to help you understand CVE-2026-74285. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70