From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring
Date: Sat, 15 Aug 2026 15:11:23 +0900 [thread overview]
Message-ID: <2026081500-CVE-2026-74356-0f94@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
vhost: fix vhost_get_avail_idx for a non empty ring
vhost_get_avail_idx is supposed to report whether it has updated
vq->avail_idx. Instead, it returns whether all entries have been
consumed, which is usually the same. But not always - in
drivers/vhost/net.c and when mergeable buffers have been enabled, the
driver checks whether the combined entries are big enough to store an
incoming packet. If not, the driver re-enables notifications with
available entries still in the ring. The incorrect return value from
vhost_get_avail_idx propagates through vhost_enable_notify and causes
the host to livelock if the guest is not making progress, as vhost will
immediately disable notifications and retry using the available entries.
This goes back to commit d3bb267bbdcb ("vhost: cache avail index in
vhost_enable_notify()") which changed vhost_enable_notify() to compare
the freshly read avail index against vq->last_avail_idx instead of the
previously cached vq->avail_idx. Commit 7ad472397667 ("vhost: move
smp_rmb() into vhost_get_avail_idx()") then carried over the same
comparison when refactoring vhost_enable_notify() to call the unified
vhost_get_avail_idx().
The obvious fix is to make vhost_get_avail_idx do what the comment
says it does and report whether new entries have been added.
The Linux kernel CVE team has assigned CVE-2026-74356 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 6.12.97 with commit e115471008111f894c6528d9ab2ce7d0ce306f35
Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 6.18.40 with commit 7f229d27bf27c7e589eca690d8612763a7a4801f
Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 7.1.5 with commit a9326b652bc7acd748d7a1143573845c7924d847
Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 7.2-rc1 with commit 09861858a68342f851f71c669ac0f69865c32151
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-74356
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/vhost/vhost.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35
https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f
https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847
https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151
reply other threads:[~2026-08-15 6:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026081500-CVE-2026-74356-0f94@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.