CVE-2026-74623

A flaw was found in the Linux kernel's atlantic network driver. When a network interface using this driver is deinitialized while under transmit (TX) or XDP_TX load, certain transmit buffers are not properly released. This oversight leads to a memory leak, which can prevent the proper shutdown of memory pools and result in continuous system warnings. The cumulative effect of these leaks can lead to resource exhaustion and impact system stability.

This vulnerability is rated as Low severity because it only affects systems equipped with Aquantia network controllers and requires privileged administrative actions while the device is actively transmitting network packets. The issue manifests during interface teardown or ring reconfiguration under heavy traffic, conditions that are uncommon in normal production operations. Furthermore, triggering interface deinitialization requires elevated privileges, preventing unprivileged local or remote actors from directly inducing the memory leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.