---
id: CVE-2026-74626
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NTB: ntb_netdev: Preserve RX queue depth on allocation failure

  ntb_netdev_rx_handler() hands the received skb to the network stack
  before allocating its replacement
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NTB: ntb_netdev: Preserve RX queue depth on allocation failure

  ntb_netdev_rx_handler() hands the received skb to the network stack
  before allocating its replacement. I…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74626'
references:
  - url: 'https://git.kernel.org/stable/c/18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/272df0fbe6f3e04e22bc67fbdd9ac24586b942f4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3f2a15f33f86f7bd5b920669fd40c06725d72a1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6d7f8a23c130d768c0976c2578b214353674e18f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcaf8ba7e56bb73319ac107a63b907d59536192c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00501
epssPercentile: 0.41237
ingestedAt: '2026-10-14T13:30:58.519Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb_netdev: Preserve RX queue depth on allocation failure

ntb_netdev_rx_handler() hands the received skb to the network stack
before allocating its replacement. If the allocation fails, nothing is
reposted. Every failure therefore takes one buffer out of the RX queue
while the interface remains up, and enough failures eventually stall
reception.

A retry path could refill the queue later, but ntb_netdev has none.
Allocate the replacement first instead. If that fails, drop the packet
and repost the same skb. This keeps the queue full and lets packet
delivery resume as soon as memory is available again.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.