Bug 2521487 (CVE-2026-74626)

Summary: CVE-2026-74626 kernel: NTB: ntb_netdev: Preserve RX queue depth on allocation failure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) virtual ethernet device (ntb_netdev). When processing incoming network packets, a failure to allocate a new buffer can lead to the removal of an existing buffer from the receive queue without replacement. Repeated occurrences of this issue can exhaust the receive queue, preventing further packet reception and resulting in a Denial of Service (DoS) for the affected system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-22 15:47:58 UTC 
In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb_netdev: Preserve RX queue depth on allocation failure

ntb_netdev_rx_handler() hands the received skb to the network stack
before allocating its replacement. If the allocation fails, nothing is
reposted. Every failure therefore takes one buffer out of the RX queue
while the interface remains up, and enough failures eventually stall
reception.

A retry path could refill the queue later, but ntb_netdev has none.
Allocate the replacement first instead. If that fails, drop the packet
and repost the same skb. This keeps the queue full and lets packet
delivery resume as soon as memory is available again.
Comment 1 gkamathe 2026-08-24 12:02:26 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74626-b133@gregkh/T