GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74285 (GCVE-0-2026-74285)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
net: Stop leased rxq before uninstalling its memory provider
Summary
In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA mappings before stopping the physical queue: __netif_mp_uninstall_rxq(virt_rxq, p); /* DMA unmap */ __netif_mp_close_rxq(phys_rxq->dev, rxq_idx, p); /* queue stop */ This inverts the ordering used by the regular teardown paths (normal device unregister and the io_uring zcrx close path), which stop the queue before revoking the provider's mappings. With the physical queue still live, its NAPI can keep consuming net_iov entries from the page_pool alloc cache after the __netif_mp_uninstall_rxq() has already cleared their dma_addr, opening a window for the device to DMA to a stale or zero address. Fix it by swapping the two calls so the queue is stopped (and its NAPI quiesced) before the provider is uninstalled. No functional regression was observed across repeated runs of the nk_qlease.py HW selftest, which exercises the lease teardown path; this was tested against fbnic QEMU emulation.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5602ad61ebee99c83081fba1aaf5814736edc3e7 , < 03f4c6ed3cffbfce0b85a3a0193d08a46692a9f8 (git)
Affected: 5602ad61ebee99c83081fba1aaf5814736edc3e7 , < 37314c9dbe95b4d924c7b61aaf563cec4f4e4133 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/netdev_rx_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03f4c6ed3cffbfce0b85a3a0193d08a46692a9f8",
              "status": "affected",
              "version": "5602ad61ebee99c83081fba1aaf5814736edc3e7",
              "versionType": "git"
            },
            {
              "lessThan": "37314c9dbe95b4d924c7b61aaf563cec4f4e4133",
              "status": "affected",
              "version": "5602ad61ebee99c83081fba1aaf5814736edc3e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/netdev_rx_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Stop leased rxq before uninstalling its memory provider\n\nnetif_rxq_cleanup_unlease() tears down the memory provider that was\ninstalled on a physical RX queue through a netkit queue lease. It\ncurrently revokes the provider\u0027s DMA mappings before stopping the\nphysical queue:\n\n  __netif_mp_uninstall_rxq(virt_rxq, p);            /* DMA unmap */\n  __netif_mp_close_rxq(phys_rxq-\u003edev, rxq_idx, p);  /* queue stop */\n\nThis inverts the ordering used by the regular teardown paths (normal\ndevice unregister and the io_uring zcrx close path), which stop the\nqueue before revoking the provider\u0027s mappings.\n\nWith the physical queue still live, its NAPI can keep consuming\nnet_iov entries from the page_pool alloc cache after the\n__netif_mp_uninstall_rxq() has already cleared their dma_addr,\nopening a window for the device to DMA to a stale or zero address.\n\nFix it by swapping the two calls so the queue is stopped (and its\nNAPI quiesced) before the provider is uninstalled. No functional\nregression was observed across repeated runs of the nk_qlease.py\nHW selftest, which exercises the lease teardown path; this was\ntested against fbnic QEMU emulation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local netlink/rtnl actions (netdev-genl QUEUE_CREATE, netkit teardown via ip link del) that invoke netif_rxq_cleanup_unlease(); remote packets alone cannot reach this teardown path.\nAC:L - The attacker controls both sides of the race by keeping RX traffic/NAPI active on the leased physical queue while concurrently deleting netkit or tearing down the lease with a memory provider installed.\nPR:L - Queue leasing, netkit creation, and memory-provider binding all require CAP_NET_ADMIN, which unprivileged users can obtain inside user/network namespaces via unshare without init-namespace root.\nUI:N - No victim interaction is required; the attacker configures the netkit lease, installs an io_uring zcrx or devmem memory provider, generates RX load, and triggers lease teardown themselves.\nS:C - Stale or zero DMA addresses let the physical NIC write outside intended buffers, crossing container/host and DMA mapping boundaries when a user-namespace tenant leases a host physical RX queue.\nC:H - Premature DMA unmap while NAPI still hands net_iov buffers to hardware enables misplaced RX DMA that can disclose or corrupt adjacent kernel/host memory beyond the intended mapping.\nI:H - The device may DMA received packet data to a cleared or stale dma_addr, providing an attacker-influenced arbitrary kernel memory write primitive during queue-lease teardown.\nA:H - Invalid DMA to stale or zero addresses can cause kernel oops/panic, NIC hangs, or fatal memory corruption during lease teardown even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:25.616Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03f4c6ed3cffbfce0b85a3a0193d08a46692a9f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/37314c9dbe95b4d924c7b61aaf563cec4f4e4133"
        }
      ],
      "title": "net: Stop leased rxq before uninstalling its memory provider",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74285",
    "datePublished": "2026-08-15T05:57:53.907Z",
    "dateReserved": "2026-08-15T05:44:03.881Z",
    "dateUpdated": "2026-08-17T05:45:25.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74285",
      "date": "2026-09-05",
      "epss": "0.0012",
      "percentile": "0.02059"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74285\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:28.037\",\"lastModified\":\"2026-08-17T06:19:22.390\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: Stop leased rxq before uninstalling its memory provider\\n\\nnetif_rxq_cleanup_unlease() tears down the memory provider that was\\ninstalled on a physical RX queue through a netkit queue lease. It\\ncurrently revokes the provider\u0027s DMA mappings before stopping the\\nphysical queue:\\n\\n  __netif_mp_uninstall_rxq(virt_rxq, p);            /* DMA unmap */\\n  __netif_mp_close_rxq(phys_rxq-\u003edev, rxq_idx, p);  /* queue stop */\\n\\nThis inverts the ordering used by the regular teardown paths (normal\\ndevice unregister and the io_uring zcrx close path), which stop the\\nqueue before revoking the provider\u0027s mappings.\\n\\nWith the physical queue still live, its NAPI can keep consuming\\nnet_iov entries from the page_pool alloc cache after the\\n__netif_mp_uninstall_rxq() has already cleared their dma_addr,\\nopening a window for the device to DMA to a stale or zero address.\\n\\nFix it by swapping the two calls so the queue is stopped (and its\\nNAPI quiesced) before the provider is uninstalled. No functional\\nregression was observed across repeated runs of the nk_qlease.py\\nHW selftest, which exercises the lease teardown path; this was\\ntested against fbnic QEMU emulation.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/netdev_rx_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5602ad61ebee99c83081fba1aaf5814736edc3e7\",\"lessThan\":\"03f4c6ed3cffbfce0b85a3a0193d08a46692a9f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5602ad61ebee99c83081fba1aaf5814736edc3e7\",\"lessThan\":\"37314c9dbe95b4d924c7b61aaf563cec4f4e4133\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/netdev_rx_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03f4c6ed3cffbfce0b85a3a0193d08a46692a9f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37314c9dbe95b4d924c7b61aaf563cec4f4e4133\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:19:00+00:00",
      "cve": "CVE-2026-74285",
      "id": "CVE-2026-74285",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: Stop leased rxq before uninstalling its memory provider",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74285.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.