CVE-2026-74310

A flaw was found in the Linux kernel's vhost/net component. This use-after-free vulnerability occurs due to incorrect handling of zerocopy user buffers, where the system may prematurely complete buffer operations while other parts of the system still hold references to the same memory. This can lead to memory corruption and potentially a denial of service (DoS) condition, causing system instability.

This vulnerability is rated as Important because an attacker interacting with virtio-net virtualization interfaces could trigger host kernel memory corruption, resulting in a system crash or potential privilege escalation. Exploitation depends on environments utilizing the vhost-net kernel subsystem to handle zerocopy network traffic alongside packet splitting or cloning operations. Because the issue compromises host kernel integrity from an interface commonly exposed to virtualized guests, it presents a substantial risk to multi-tenant hypervisors running Red Hat Enterprise Linux.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the vhost_net kernel module from being loaded by creating a configuration file under /etc/modprobe.d/:

# echo "install vhost_net /bin/true" > /etc/modprobe.d/disable-vhost_net.conf
# echo "blacklist vhost_net" >> /etc/modprobe.d/disable-vhost_net.conf

If the module is currently loaded, unload it with:

# modprobe -r vhost_net

Caveats: Disabling or unloading vhost_net forces virtual machine networking to fall back to userspace emulation, which may degrade network throughput for guest workloads.

Warning: If active virtual machines are currently utilizing vhost_net, unloading the module will fail. A system reboot or terminating running virtual machines is required for the configuration change to take effect.