Executive brief
The Linux kernel's network subsystem contains a race condition in the teardown of leased receive queues. When a memory provider is removed from a physical receive queue, the queue is stopped after DMA mappings are revoked instead of before, allowing network hardware to issue DMA operations to stale memory addresses. This can cause data corruption, system crashes, or potential unauthorized memory access on systems using the netkit queue lease feature.
Technical details
The vulnerability exists in the netif_rxq_cleanup_unlease() function in net/core/netdev_rx_queue.c. The function was calling __netif_mp_uninstall_rxq() to revoke DMA mappings before calling __netif_mp_close_rxq() to stop the physical queue, inverting the safe order used elsewhere in the kernel. While the physical queue remains active, its NAPI context can continue to consume net_iov entries from the page pool allocation cache after their dma_addr fields have been cleared, creating a window where the network device may DMA to invalid or zero addresses. The fix reorders these two function calls to stop the queue (and quiesce NAPI) before uninstalling the memory provider. This is a logic bug requiring code modification, not a runtime exploit; the patch affects queue lease teardown paths used in netkit networking.
Affected products
- Linux Linux Kernel Affected versions include those with netkit queue lease support (approximately 6.10 and later prior to the fix)
Timeline
- 2026-08-15: disclosed: CVE-2026-74285 published
- 2026-06-09: patched: Fix committed upstream by Daniel Borkmann
- 2026-07-24: patched: Fix included in stable kernel releases