CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring

CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vhost: fix vhost_get_avail_idx for a non empty ring

vhost_get_avail_idx is supposed to report whether it has updated
vq->avail_idx. Instead, it returns whether all entries have been
consumed, which is usually the same. But not always - in
drivers/vhost/net.c and when mergeable buffers have been enabled, the
driver checks whether the combined entries are big enough to store an
incoming packet. If not, the driver re-enables notifications with
available entries still in the ring. The incorrect return value from
vhost_get_avail_idx propagates through vhost_enable_notify and causes
the host to livelock if the guest is not making progress, as vhost will
immediately disable notifications and retry using the available entries.

This goes back to commit d3bb267bbdcb ("vhost: cache avail index in
vhost_enable_notify()") which changed vhost_enable_notify() to compare
the freshly read avail index against vq->last_avail_idx instead of the
previously cached vq->avail_idx. Commit 7ad472397667 ("vhost: move
smp_rmb() into vhost_get_avail_idx()") then carried over the same
comparison when refactoring vhost_enable_notify() to call the unified
vhost_get_avail_idx().

The obvious fix is to make vhost_get_avail_idx do what the comment
says it does and report whether new entries have been added.

The Linux kernel CVE team has assigned CVE-2026-74356 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 6.12.97 with commit e115471008111f894c6528d9ab2ce7d0ce306f35
	Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 6.18.40 with commit 7f229d27bf27c7e589eca690d8612763a7a4801f
	Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 7.1.5 with commit a9326b652bc7acd748d7a1143573845c7924d847
	Issue introduced in 5.18 with commit d3bb267bbdcba199568f1325743d9d501dea0560 and fixed in 7.2-rc1 with commit 09861858a68342f851f71c669ac0f69865c32151

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74356
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vhost/vhost.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35
	https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f
	https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847
	https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151