CVE-2026-74356

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vhost component where the function vhost get avail idx() incorrectly reports whether all entries have been consumed instead of reporting if vq->avail idx has been updated. In drivers/vhost/net.c, when mergeable buffers are enabled, the driver may re-enable notifications while entries still remain in the ring if the combined entries are insufficient for an incoming packet. This incorrect return value propagates through vhost enable notify(), potentially causing a host livelock—a state where the system remains active but makes no progress—if the guest is not advancing, as the host continuously disables notifications and retries using available entries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.