CVE-2026-74626

A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) virtual ethernet driver (ntb_netdev). The ntb_netdev_rx_handler() function hands each received socket buffer to the network stack before allocating its replacement. When that allocation fails, nothing is reposted to the receive queue, so every failure permanently removes one RX buffer while the interface remains up. Repeated allocation failures under memory pressure can therefore exhaust the receive queue and stall packet reception on the NTB virtual ethernet link, resulting in a denial of service. Only availability is affected; the flaw is a resource-handling failure with no evidence of confidentiality or integrity impact. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support, 8, 9, and 10, and in Red Hat In-Vehicle OS 2, are affected, with the fix currently deferred for these products; until a fix is shipped, the residual risk is a gradual loss of receive traffic on NTB links on systems experiencing memory allocation failures. Red Hat rates this flaw as Moderate (CVSS 5.5) rather than the upstream CVEORG Important rating (CVSS 7.5, AV:N) because the ntb_netdev device operates on an NTB link that requires a directly connected peer in a tightly coupled hardware environment rather than general network reachability, and triggering the issue also requires repeated memory allocation failures that are not reliably controllable by an attacker.