{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "9fe31b3f314534e238aa6d0b6fb492134cbcf8be"
            },
            {
              "fixed": "b662a1fb4f3a5ea19bac24eea8315b1d05be51e7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "dc82a33297fc2c58cb0b2b008d728668d45c0f6a"
            },
            {
              "fixed": "73f8dd22b1e533a99ecc3f9b5de6c6daccaecace"
            },
            {
              "fixed": "90bb11fb29d3c55a2c46dc7c386d096b286e7fcf"
            },
            {
              "fixed": "60db47f02bfa2aa688938aa199117ec4f8e31d23"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.61"
            },
            {
              "fixed": "6.12.105"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.46"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.16.0"
            },
            {
              "fixed": "7.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74742.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix queue index used to wake the peer txq in veth_poll\n\nveth_poll() derives the index of the peer TX queue to wake from\nrq-\u003exdp_rxq.queue_index. That field is only initialized by\nxdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an\nXDP program is attached. On the plain GRO/NAPI path\n(veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so\nqueue_index stays 0 for every queue, as priv-\u003erq is zero-allocated.\n\nSo in a multi-queue setup with GRO enabled and no XDP program attached,\nevery NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops\npeer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing\never wakes it again: the poller draining queue 1 wakes queue 0 instead.\nveth implements no ndo_tx_timeout, so the netdev watchdog does not kick\nin either, and the queue stays stopped indefinitely.\n\nDerive the index from the position of the rq within priv-\u003erq instead,\nwhich is correct regardless of whether XDP was ever enabled.\n\nScripts to reproduce the stall are available at\nhttps://github.com/netoptimizer/veth-backpressure-performance-testing",
  "id": "CVE-2026-74742",
  "modified": "2026-08-28T03:30:52.938259748Z",
  "published": "2026-08-26T14:36:53.580Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/60db47f02bfa2aa688938aa199117ec4f8e31d23"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/73f8dd22b1e533a99ecc3f9b5de6c6daccaecace"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90bb11fb29d3c55a2c46dc7c386d096b286e7fcf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b662a1fb4f3a5ea19bac24eea8315b1d05be51e7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74742.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74742"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "veth: fix queue index used to wake the peer txq in veth_poll"
}