{"id":"CVE-2026-74356","title":"vhost: fix vhost_get_avail_idx for a non empty ring","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq->avail_idx. Instead, it returns whether all ent…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-253"],"vendor":"Linux","product":"Linux","affected":["Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 0fe5ca2d56f0122988016e415a074c95925504b7","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < e115471008111f894c6528d9ab2ce7d0ce306f35","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 7f229d27bf27c7e589eca690d8612763a7a4801f","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < a9326b652bc7acd748d7a1143573845c7924d847","Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 09861858a68342f851f71c669ac0f69865c32151","Linux 5.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:54:24.183895Z"},"published":"2026-08-15","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:45:28.112Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74356","references":[{"url":"https://git.kernel.org/stable/c/0fe5ca2d56f0122988016e415a074c95925504b7"},{"url":"https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35"},{"url":"https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f"},{"url":"https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847"},{"url":"https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74356.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-74356"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516746"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74356"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74356"},{"url":"https://lore.kernel.org/linux-cve-announce/2026081500-CVE-2026-74356-0f94@gregkh/T"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00244,"epssPercentile":0.15538,"scores":{"cna":7.4,"vendor":5.5},"ingestedAt":"2026-10-16T19:46:24.374Z","slug":"CVE-2026-74356","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq->avail_idx. Instead, it returns whether all entries have been\nconsumed, which is usually the same. But not always - in\ndrivers/vhost/net.c and when mergeable buffers have been enabled, the\ndriver checks whether the combined entries are big enough to store an\nincoming packet. If not, the driver re-enables notifications with\navailable entries still in the ring. The incorrect return value from\nvhost_get_avail_idx propagates through vhost_enable_notify and causes\nthe host to livelock if the guest is not making progress, as vhost will\nimmediately disable notifications and retry using the available entries.\n\nThis goes back to commit d3bb267bbdcb (\"vhost: cache avail index in\nvhost_enable_notify()\") which changed vhost_enable_notify() to compare\nthe freshly read avail index against vq->last_avail_idx instead of the\npreviously cached vq->avail_idx. Commit 7ad472397667 (\"vhost: move\nsmp_rmb() into vhost_get_avail_idx()\") then carried over the same\ncomparison when refactoring vhost_enable_notify() to call the unified\nvhost_get_avail_idx().\n\nThe obvious fix is to make vhost_get_avail_idx do what the comment\nsays it does and report whether new entries have been added.\n\n## Affected\n\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 0fe5ca2d56f0122988016e415a074c95925504b7`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < e115471008111f894c6528d9ab2ce7d0ce306f35`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 7f229d27bf27c7e589eca690d8612763a7a4801f`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < a9326b652bc7acd748d7a1143573845c7924d847`\n- `Linux >= d3bb267bbdcba199568f1325743d9d501dea0560 < 09861858a68342f851f71c669ac0f69865c32151`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74356.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227187,"id":"CVE-2026-74356","ts":1792586970023,"field":"cvss","old":"5.5","new":"7.4"},{"seq":227186,"id":"CVE-2026-74356","ts":1792586970023,"field":"severity","old":"medium","new":"high"},{"seq":223603,"id":"CVE-2026-74356","ts":1792238335646,"field":"cvss","old":"7.4","new":"5.5"},{"seq":223602,"id":"CVE-2026-74356","ts":1792238335646,"field":"severity","old":"high","new":"medium"}]}