Executive brief
The Atlantic network interface driver in the Linux kernel leaks memory pages and DMA mappings when network interfaces are brought down. A batch-refill optimization causes received buffers to accumulate in a gap that the cleanup routine skips, resulting in resource leaks on every interface shutdown.
Technical details
The vulnerability is a resource leak in the aq_ring_rx_deinit() function of the Atlantic Ethernet driver (drivers/net/ethernet/aquantia/atlantic/aq_ring.c). The driver implements a page-reuse optimization for RX buffers, where cleaned buffers retain their pages for reuse and refill operations are batched—the aq_ring_rx_fill() function returns early until AQ_CFG_RX_REFILL_THRES free slots are available. The original deinit walk only processed the region between sw_head and sw_tail (hardware-posted buffers), skipping the complementary gap where consumed-but-not-yet-reposted buffers accumulate with live pages and DMA mappings. This causes up to one refill batch worth of pages and DMA mappings to leak on every interface down. The fix changes the cleanup loop to walk the entire ring and release all remaining pages, and adds a null check for buff_ring to handle partial allocation failures. Local access is required (root privileges to bring interfaces down). The patch is available in upstream Linux and stable branches from v5.2 onward.
Affected products
- Linux Linux kernel v5.2 and later
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Upstream commit e8e7471ef686b6c002218fee9671cc61992ae01a merged to stable