CVE-2026-74356

A flaw was found in the Linux kernel's vhost subsystem. An incorrect return value from the vhost_get_avail_idx function can cause the host to livelock. A malicious guest operating system (OS) can exploit this by not processing virtqueue entries, leading to the host repeatedly disabling notifications and retrying, resulting in a Denial of Service (DoS) on the host system.

A moderate severity denial of service flaw was found in the Linux kernel's vhost subsystem, affecting the kernel and kernel-rt packages that Red Hat ships in Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2. The vhost_get_avail_idx() function was supposed to report whether it had updated vq->avail_idx, but instead it returned whether all virtqueue entries had been consumed. In drivers/vhost/net.c, when mergeable buffers are enabled and the combined available entries are too small to store an incoming packet, the driver re-enables notifications with available entries still in the ring; the incorrect return value propagates through vhost_enable_notify(), causing vhost to immediately disable notifications and retry the same entries, which livelocks the host if the guest is not making progress. A malicious guest operating system can therefore cause a denial of service on the host by not processing virtqueue entries, with no impact on confidentiality or integrity. The vulnerable code was introduced by upstream commit d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()"), which first appeared in Red Hat Enterprise Linux 9.3; consequently, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and RHEL 9.2 streams are not affected because the vulnerable code is not present. The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 streams has been deferred to a future update; the residual risk is limited because triggering the livelock requires a malicious guest running on the host and the issue is not network reachable from outside the virtualization boundary. Red Hat rates this flaw as Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVEORG score of 7.4 (Important), because reliable triggering requires control of a guest on the affected host rather than an unprivileged adjacent-network attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.