FKIE_CVE-2026-74626

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-16 20:17
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore takes one buffer out of the RX queue while the interface remains up, and enough failures eventually stall reception. A retry path could refill the queue later, but ntb_netdev has none. Allocate the replacement first instead. If that fails, drop the packet and repost the same skb. This keeps the queue full and lets packet delivery resume as soon as memory is available again.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/272df0fbe6f3e04e22bc67fbdd9ac24586b942f4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3f2a15f33f86f7bd5b920669fd40c06725d72a1e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d7f8a23c130d768c0976c2578b214353674e18f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fcaf8ba7e56bb73319ac107a63b907d59536192c
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ntb_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d7f8a23c130d768c0976c2578b214353674e18f",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "272df0fbe6f3e04e22bc67fbdd9ac24586b942f4",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "fcaf8ba7e56bb73319ac107a63b907d59536192c",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "3f2a15f33f86f7bd5b920669fd40c06725d72a1e",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "a4e340971fe8ccd245d206db4d43b2a0eec240bd",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "755fd7843f300d724caceabdf9bb13adc8701540",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "d2121faf133ac3bf9531b53a7e21273649a08517",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ntb_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_netdev: Preserve RX queue depth on allocation failure\n\nntb_netdev_rx_handler() hands the received skb to the network stack\nbefore allocating its replacement. If the allocation fails, nothing is\nreposted. Every failure therefore takes one buffer out of the RX queue\nwhile the interface remains up, and enough failures eventually stall\nreception.\n\nA retry path could refill the queue later, but ntb_netdev has none.\nAllocate the replacement first instead. If that fails, drop the packet\nand repost the same skb. This keeps the queue full and lets packet\ndelivery resume as soon as memory is available again."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNTB: ntb_netdev: Preservar la profundidad de la cola RX en caso de fallo de asignaci\u00f3n\n\nntb_netdev_rx_handler() entrega el skb recibido a la pila de red antes de asignar su reemplazo. Si la asignaci\u00f3n falla, nada es republicado. Cada fallo, por lo tanto, saca un b\u00fafer de la cola RX mientras la interfaz permanece activa, y suficientes fallos eventualmente detienen la recepci\u00f3n.\n\nUna ruta de reintento podr\u00eda rellenar la cola m\u00e1s tarde, pero ntb_netdev no tiene ninguna. En su lugar, asignar primero el reemplazo. Si eso falla, descartar el paquete y republicar el mismo skb. Esto mantiene la cola llena y permite que la entrega de paquetes se reanude tan pronto como la memoria est\u00e9 disponible de nuevo."
    }
  ],
  "id": "CVE-2026-74626",
  "lastModified": "2026-10-16T20:17:47.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-74626",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T19:02:49.614749Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-22T16:16:35.517",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/272df0fbe6f3e04e22bc67fbdd9ac24586b942f4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3f2a15f33f86f7bd5b920669fd40c06725d72a1e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6d7f8a23c130d768c0976c2578b214353674e18f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fcaf8ba7e56bb73319ac107a63b907d59536192c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.