CVE-2026-74626 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore takes one buffer out of the RX queue while the interface remains up, and enough failures eventually stall reception.
A retry path could refill the queue later, but ntb_netdev has none. Allocate the replacement first instead. If that fails, drop the packet and repost the same skb. This keeps the queue full and lets packet delivery resume as soon as memory is available again.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/23/2026
The vulnerability identified in the Linux kernel's Non-Transparent Bridge network device driver, specifically within the ntb_netdev module, represents a resource management flaw that can lead to service degradation or denial of service conditions under specific load scenarios. This issue stems from an incorrect sequence of operations during packet reception handling where the system fails to maintain buffer integrity when memory allocation for replacement buffers encounters failures. The root cause lies in how the receive handler processes incoming network packets, specifically regarding the lifecycle management of socket buffers which are critical for maintaining continuous data flow across the non-transparent bridge interface.
In a typical high-performance networking environment using NTB technology, the driver relies on a pre-allocated pool of memory buffers to store incoming packet data efficiently. The ntb_netdev_rx_handler function is responsible for processing these received packets and passing them up the network stack to higher-level protocols such as TCP or UDP. However, before handing over an existing socket buffer to the kernel networking subsystem, the driver attempts to allocate a new replacement buffer to replenish the receive queue. This allocation step is critical because if it fails due to memory pressure or fragmentation, the original logic does not provide any mechanism to recover or retry. Consequently, when the allocation fails, the system has already released its reference to the current buffer by passing it up the stack without securing a replacement.
This sequence creates a cumulative resource leak within the receive queue structure of the network interface. Each time an allocation failure occurs during packet processing, one slot in the RX ring is permanently removed from circulation because no new buffer was successfully allocated to take its place. Since there is no retry path or background replenishment mechanism implemented in this specific driver version, these failures are not transient but rather persistent as long as memory pressure exists. Over time, and particularly under sustained network traffic loads where allocation failures become more frequent due to system-wide resource constraints, the RX queue depth steadily decreases until it reaches zero.
The operational impact of this flaw is a progressive stall in packet reception capabilities for the NTB interface. As the receive queue empties, the driver loses its ability to accept new incoming packets from the hardware ring buffer. This results in silent data loss where network traffic arrives at the physical layer but is discarded because there are no available buffers to hold it. For applications relying on this connection, such as remote management sessions or high-throughput data transfers facilitated by NTB links, this manifests as increasing latency followed by complete connectivity failure. The interface remains technically up and operational in terms of link state, but functionally it becomes unable to process any further inbound traffic until the queue is manually refilled or the system memory situation improves significantly enough for allocations to succeed again without prior depletion.
From a security perspective, this vulnerability aligns with CWE-401 which describes missing release of memory after successful allocation leading to resource exhaustion. It also relates to CWE-789 concerning memory leakage that can be exploited by an attacker who generates high volumes of network traffic or induces system-wide memory pressure to trigger the allocation failures more frequently. By deliberately stressing the system, a malicious actor could accelerate the depletion of RX buffers, effectively causing a denial of service against any services hosted on or traversing this NTB interface without needing to exploit code execution flaws. This makes it a potential vector for availability-based attacks in environments where NTB is used for critical inter-system communication.
The mitigation strategy implemented involves reordering the allocation and handoff logic within the receive handler. Instead of passing the socket buffer up the stack first, the driver now attempts to allocate the replacement buffer before releasing the current one. If this pre-allocation succeeds, the new buffer replaces the old one in the queue, ensuring continuity. Crucially, if the allocation fails, the code path is modified to drop the incoming packet immediately and repost the original socket buffer back into the receive ring. This ensures that even under memory pressure, the RX queue depth remains constant because every consumed slot is either replaced by a new valid buffer or returned with its data intact for future processing once resources become available.
This fix adheres to best practices in network driver development where resource acquisition should precede resource release whenever possible to prevent race conditions and state inconsistencies. It also reflects principles found in ATT&CK technique T1498 related to Network Denial of Service, by addressing the underlying mechanism that allows an attacker or environmental stressor to degrade service availability through buffer exhaustion. By ensuring that the receive queue is never left with fewer buffers than its configured depth due to allocation failures, the driver maintains robustness against transient memory issues and prevents the gradual degradation that leads to complete functional failure of the network interface.