Linux Kernel CVE-2026-74285

Exploitation requires three concurrent conditions: (1) the target system must have a netkit virtual network device configured with a queue lease that installs a memory provider on a physical NIC's RX queue - this is a non-default, explicitly configured deployment using io_uring zero-copy receive (zcrx); (2) the attacker must have low-privilege local access sufficient to interact with the io_uring/netkit context or otherwise trigger the lease teardown code path; and (3) exploitation depends on a narrow race window that exists only during the teardown of the lease, requiring timing alignment between the DMA unmap and active NAPI polling on the physical queue. What limits exploitation: the feature must be deliberately enabled and in active use; the race window is transient and not reliably reproducible across all hardware; no network-reachable attack surface exists (AV:L confirmed by CVSS vector); and the physical NIC's IOMMU configuration affects whether a mis-directed DMA write reaches sensitive memory or faults safely.

The NVD CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a high-severity local vulnerability with scope change - the scope change (S:C) is the most operationally significant signal here, indicating that memory corruption via mis-directed DMA can affect system components outside the vulnerable process, including kernel memory of other processes or hypervisor state. However, AC:L may overstate ease of exploitation: the race window is inherently narrow (it exists only during the transient teardown moment) and requires the non-default netkit queue lease configuration with a memory provider installed. EPSS at 0.15% (5th percentile) aligns with the narrow applicability - this is not a broadly triggerable condition. No CISA KEV listing is present and no POC has been identified at time of analysis. The SSVC signals are: Exploitation=None, Automatable=No (requires specific local configuration and precise timing), Technical Impact=Total (S:C with CHI:H implies total system compromise potential). Net assessment: this is a real, high-severity issue for environments running workloads that use io_uring zero-copy RX with netkit, but the realistic attack surface is narrow and targeted exploitation in the wild is unlikely given the low EPSS and absence of KEV listing.

A low-privileged local user on a server running an io_uring zero-copy RX workload with a netkit virtual device triggers or races the lease teardown path - for example by closing the io_uring context while the physical NIC's NAPI is actively polling. During the brief window between DMA address invalidation and queue quiescence, the NIC's hardware DMA engine writes received packet data to the now-zero or stale physical address, potentially corrupting kernel memory mapped at that address. No public POC exists at time of analysis, but the kernel commit message notes the bug was reproducible via the nk_qlease.py hardware selftest against fbnic QEMU emulation.