{"id":"CVE-2026-74356","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-74356","summary":"vhost: fix vhost_get_avail_idx for a non empty ring","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq->avail_idx. Instead, it returns whether all entries have been\nconsumed, which is usually the same. But not always - in\ndrivers/vhost/net.c and when mergeable buffers have been enabled, the\ndriver checks whether the combined entries are big enough to store an\nincoming packet. If not, the driver re-enables notifications with\navailable entries still in the ring. The incorrect return value from\nvhost_get_avail_idx propagates through vhost_enable_notify and causes\nthe host to livelock if the guest is not making progress, as vhost will\nimmediately disable notifications and retry using the available entries.\n\nThis goes back to commit d3bb267bbdcb (\"vhost: cache avail index in\nvhost_enable_notify()\") which changed vhost_enable_notify() to compare\nthe freshly read avail index against vq->last_avail_idx instead of the\npreviously cached vq->avail_idx. Commit 7ad472397667 (\"vhost: move\nsmp_rmb() into vhost_get_avail_idx()\") then carried over the same\ncomparison when refactoring vhost_enable_notify() to call the unified\nvhost_get_avail_idx().\n\nThe obvious fix is to make vhost_get_avail_idx do what the comment\nsays it does and report whether new entries have been added.","published":"2026-08-15T05:58:41.445Z","modified":"2026-08-18T03:56:54.423504374Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.97"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74356.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74356"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:54.423504374Z"}}