{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "d3bb267bbdcba199568f1325743d9d501dea0560"
            },
            {
              "fixed": "e115471008111f894c6528d9ab2ce7d0ce306f35"
            },
            {
              "fixed": "7f229d27bf27c7e589eca690d8612763a7a4801f"
            },
            {
              "fixed": "a9326b652bc7acd748d7a1143573845c7924d847"
            },
            {
              "fixed": "09861858a68342f851f71c669ac0f69865c32151"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.18.0"
            },
            {
              "fixed": "6.12.97"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.40"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74356.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: fix vhost_get_avail_idx for a non empty ring\n\nvhost_get_avail_idx is supposed to report whether it has updated\nvq-\u003eavail_idx. Instead, it returns whether all entries have been\nconsumed, which is usually the same. But not always - in\ndrivers/vhost/net.c and when mergeable buffers have been enabled, the\ndriver checks whether the combined entries are big enough to store an\nincoming packet. If not, the driver re-enables notifications with\navailable entries still in the ring. The incorrect return value from\nvhost_get_avail_idx propagates through vhost_enable_notify and causes\nthe host to livelock if the guest is not making progress, as vhost will\nimmediately disable notifications and retry using the available entries.\n\nThis goes back to commit d3bb267bbdcb (\"vhost: cache avail index in\nvhost_enable_notify()\") which changed vhost_enable_notify() to compare\nthe freshly read avail index against vq-\u003elast_avail_idx instead of the\npreviously cached vq-\u003eavail_idx. Commit 7ad472397667 (\"vhost: move\nsmp_rmb() into vhost_get_avail_idx()\") then carried over the same\ncomparison when refactoring vhost_enable_notify() to call the unified\nvhost_get_avail_idx().\n\nThe obvious fix is to make vhost_get_avail_idx do what the comment\nsays it does and report whether new entries have been added.",
  "id": "CVE-2026-74356",
  "modified": "2026-08-18T03:31:17.581734386Z",
  "published": "2026-08-15T05:58:41.445Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/09861858a68342f851f71c669ac0f69865c32151"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7f229d27bf27c7e589eca690d8612763a7a4801f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9326b652bc7acd748d7a1143573845c7924d847"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e115471008111f894c6528d9ab2ce7d0ce306f35"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74356.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74356"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vhost: fix vhost_get_avail_idx for a non empty ring"
}