Executive brief
The Linux kernel's Aquantia Atlantic network driver has a memory leak in how it cleans up transmission buffers when a network interface is brought down. During shutdown, the driver fails to properly free all pending network packets and XDP frames, causing memory to be permanently lost. This silent leak becomes especially problematic when using XDP (extended Berkeley Packet Filter) features, potentially preventing proper resource cleanup and triggering system warnings.
Technical details
The vulnerability is a resource leak in aq_vec_deinit() within the Atlantic driver's ring management code. The root cause is that aq_ring_tx_clean() only processes up to AQ_CFG_TX_CLEAN_BUDGET (256) descriptors before stopping at the hardware head pointer, leaving completed descriptors beyond the budget and any frames between hardware head and software tail unfreed. When aq_vec_ring_free() subsequently deallocates the ring buffer, these socket buffers (skb) and XDP frames remain referenced but orphaned. The fix restores aq_ring_tx_deinit() to perform complete deallocation of all pending frames with proper DMA unmapping, including xdp_frames via xdp_return_frame(). This runs in process context and requires no user interaction to trigger during normal interface shutdown.
Affected products
- Linux Linux kernel v4.11 and later
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched