CVE-2026-74623: net: atlantic: free stranded TX buffers on ring deinit

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: free stranded TX buffers on ring deinit

aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()
call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and
stops at hw_head, which no longer moves once aq_vec_stop() has stopped
the hardware and NAPI. Completed descriptors beyond the budget and
everything still posted in [hw_head, sw_tail) keep their skb or
xdp_frame when the interface goes down: aq_vec_ring_free() then frees
the buffer ring and the references are lost for good.

Today this is a silent memory leak on every interface down under
TX/XDP_TX load. With the conversion of the RX path to page_pool posted
for net-next it becomes much more visible: XDP_TX frames carry fragment
references on the RX ring's page_pool, so a single stranded frame keeps
the pool's inflight count above zero forever. page_pool_destroy() then
never completes, the pool is leaked together with its pages, and
"page_pool_release_retry() stalled pool shutdown" is warned every 60
seconds from that point on, on every ifdown, XDP detach or ring resize
under XDP_TX load.

Bring back aq_ring_tx_deinit() as it was before the removal and use it
for teardown again, with one extension: TX rings can hold xdp_frames
nowadays, so release those too. They are returned with
xdp_return_frame() since this runs in process context.

The Linux kernel CVE team has assigned CVE-2026-74623 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 6.1.183 with commit 307d80193b4a4a75b8dc4e0d3162be3755abbed7
	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 6.6.152 with commit 7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c
	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 6.12.104 with commit 3447641d361dcc5511841d986ad4d849b2900d9b
	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 6.18.45 with commit b13202d401e1a20fec89b0cda733dcbaf279f79d
	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 7.1.9 with commit dd633280de7fdfd60dc4fcf63d04e2ad95b43269
	Issue introduced in 4.11 with commit eb36bedf28be6d986bdbcfa375bab08ffa45efd8 and fixed in 7.2 with commit 452636ea5410a96e02ebaaf80b21e3620b98e0dd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74623
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/aquantia/atlantic/aq_ring.c
	drivers/net/ethernet/aquantia/atlantic/aq_ring.h
	drivers/net/ethernet/aquantia/atlantic/aq_vec.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/307d80193b4a4a75b8dc4e0d3162be3755abbed7
	https://git.kernel.org/stable/c/7a3e1481f4ee6c581bccc6bfc6c970aac5be7b0c
	https://git.kernel.org/stable/c/3447641d361dcc5511841d986ad4d849b2900d9b
	https://git.kernel.org/stable/c/b13202d401e1a20fec89b0cda733dcbaf279f79d
	https://git.kernel.org/stable/c/dd633280de7fdfd60dc4fcf63d04e2ad95b43269
	https://git.kernel.org/stable/c/452636ea5410a96e02ebaaf80b21e3620b98e0dd