CVE-2026-74626
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore takes one buffer out of the RX queue while the interface remains up, and enough failures eventually stall reception. A retry path could refill the queue later, but ntb_netdev has none. Allocate the replacement first instead. If that fails, drop the packet and repost the same skb. This keeps the queue full and lets packet delivery resume as soon as memory is available again.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.50% probability · 43th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS 0.5% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://git.kernel.org/stable/c/18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5
- https://git.kernel.org/stable/c/272df0fbe6f3e04e22bc67fbdd9ac24586b942f4
- https://git.kernel.org/stable/c/3f2a15f33f86f7bd5b920669fd40c06725d72a1e
- https://git.kernel.org/stable/c/6d7f8a23c130d768c0976c2578b214353674e18f
- https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540
- https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd
- https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517
- https://git.kernel.org/stable/c/fcaf8ba7e56bb73319ac107a63b907d59536192c
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.