CVE-2026-74309

A flaw was found in the Linux kernel's vdpa/octeon_ep component. This vulnerability involves an incorrect mapping of Interrupt Request (IRQ) numbers to processing rings within the interrupt handler. The system incorrectly calculates the IRQ index, which can lead to misdirected or mishandled interrupts. This issue could potentially cause system instability or unexpected operational behavior.

A flaw of moderate impact was found in the Linux kernel's vdpa/octeon_ep driver. The interrupt handler computed the index of the processing ring for an incoming interrupt by assuming that the device's allocated IRQ numbers are contiguous and based at the first allocated IRQ (irq - irqs[0]). When the allocated IRQ numbers are non-contiguous, this calculation produces an incorrect ring index, so interrupts are handled against the wrong ring, which can lead to misdirected or mishandled interrupts, system instability, or denial of service. Exploiting this flaw requires local access to a system with the affected Octeon endpoint vdpa device in use, and the impact is limited to availability; Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The significantly higher CVE.org score of 10.0 does not reflect the actual prerequisites and impact of this flaw, as it is not remotely exploitable and has no confidentiality or integrity impact. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams are marked not affected because the vulnerable code is not present in those packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.