CVE-2026-74312

Received Received - Intake

Vhost vDPA Queue Index Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks. Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location. From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74312

EUVD

EUVD-2026-59459

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of virtqueue indices in the vhost/vdpa subsystem. The functions vhost_vdpa_mmap() and vhost_vdpa_fault() use an unvalidated index from user space, which could allow an attacker to specify an out-of-bounds queue index. This may lead to invalid PFN remaps and potential crashes or denial-of-service conditions.

Detection Guidance

This vulnerability affects the Linux kernel's vhost/vdpa subsystem. Detection requires checking kernel version and vhost/vdpa module usage. Inspect loaded kernel modules with lsmod | grep vhost_vdpa. Check kernel version with uname -r. Monitor system logs for crashes or errors related to vhost_vdpa.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a system crash or denial-of-service by triggering invalid memory remaps. It may also lead to unauthorized access or corruption of kernel memory, depending on the driver-specific callback implementation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel memory access issue. However, if exploited, it could lead to system crashes or denial of service, potentially disrupting data processing or availability, which may indirectly impact compliance with availability-related requirements in these standards.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the vhost/vdpa vulnerability. If immediate patching is not possible, disable the vhost_vdpa module with modprobe -r vhost_vdpa. Restrict access to vulnerable systems until patched.

Hi! I’m here to help you understand CVE-2026-74312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70