Bug 2517045 (CVE-2026-74495)

Summary:	CVE-2026-74495 kernel: igbvf: Fix leak in TX DMA error cleanup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the igbvf driver of the Linux kernel. An off-by-one error during the cleanup of transmit (TX) Direct Memory Access (DMA) buffer mappings can lead to a memory leak. If an error occurs while mapping TX buffers, one DMA mapping may not be properly unmapped, potentially impacting system stability or performance over time.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:46:40 UTC

In the Linux kernel, the following vulnerability has been resolved:

igbvf: Fix leak in TX DMA error cleanup

If an error is encountered while mapping TX buffers, the driver should
unmap any buffers already mapped for that skb.

Because count is incremented before each frag mapping, it will always
match the correct number of unmappings needed when dma_error is reached.
Decrementing count before the while loop in dma_error causes an
off-by-one error. If any mapping was successful before an unsuccessful
mapping, exactly one DMA mapping (the head) would leak.

This bug was introduced by a 2010 fix for an endless loop in dma_error.
All other affected drivers have already been fixed.

Comment 1 Mauro Matteo Cascella 2026-08-19 18:00:17 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081539-CVE-2026-74495-d005@gregkh/T