{"id":"CVE-2026-74356","title":"vhost: fix vhost_get_avail_idx for a non empty ring","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq->avail_idx. Instead, it returns whether all ent…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < e115471008111f894c6528d9ab2ce7d0ce306f35","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 7f229d27bf27c7e589eca690d8612763a7a4801f","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < a9326b652bc7acd748d7a1143573845c7924d847","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 09861858a68342f851f71c669ac0f69865c32151","Linux 5.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:54:24.183895Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:35.157Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74356","references":[{"url":"https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35"},{"url":"https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f"},{"url":"https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847"},{"url":"https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151"}],"tags":["cve.org"],"epss":0.00232,"epssPercentile":0.13125,"ingestedAt":"2026-10-16T19:46:24.374Z","slug":"CVE-2026-74356","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq->avail_idx. Instead, it returns whether all entries have been\nconsumed, which is usually the same. But not always - in\ndrivers/vhost/net.c and when mergeable buffers have been enabled, the\ndriver checks whether the combined entries are big enough to store an\nincoming packet. If not, the driver re-enables notifications with\navailable entries still in the ring. The incorrect return value from\nvhost_get_avail_idx propagates through vhost_enable_notify and causes\nthe host to livelock if the guest is not making progress, as vhost will\nimmediately disable notifications and retry using the available entries.\n\nThis goes back to commit d3bb267bbdcb (\"vhost: cache avail index in\nvhost_enable_notify()\") which changed vhost_enable_notify() to compare\nthe freshly read avail index against vq->last_avail_idx instead of the\npreviously cached vq->avail_idx. Commit 7ad472397667 (\"vhost: move\nsmp_rmb() into vhost_get_avail_idx()\") then carried over the same\ncomparison when refactoring vhost_enable_notify() to call the unified\nvhost_get_avail_idx().\n\nThe obvious fix is to make vhost_get_avail_idx do what the comment\nsays it does and report whether new entries have been added.\n\n## Affected\n\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < e115471008111f894c6528d9ab2ce7d0ce306f35`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 7f229d27bf27c7e589eca690d8612763a7a4801f`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < a9326b652bc7acd748d7a1143573845c7924d847`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 09861858a68342f851f71c669ac0f69865c32151`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}