Linux Kernel CVE-2026-74309

Exploitation requires the target to run the Linux kernel vdpa/octeon_ep driver on Marvell OCTEON EP hardware with the vDPA datapath active, AND the platform must assign IRQs that are non-contiguous or whose base is not irqs[0] - on systems with contiguous zero-based IRQ allocation the buggy arithmetic produces the correct index and the flaw does not manifest. The condition is a hardware/platform IRQ-allocation property, not an attacker-tunable setting, which significantly limits realistic exploitation. Limiting factors: the specific vendor NIC must be present and bound to the driver, the vDPA path must be in use, and there is no network-facing trigger despite the input vector's AV:N - access to or operation of the local device datapath is required.

The signals conflict sharply. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a remote, unauthenticated, scope-changing critical RCE, but the description describes a kernel driver interrupt-mapping correction reachable only on specific OCTEON EP hardware running vDPA - there is no network-facing attack surface implied. This 10.0 score is a known artifact of automated maximum scoring applied to Linux kernel CVEs and should not be treated as authoritative. Corroborating low-risk signals: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. The realistic impact is misrouted interrupt handling, which the source tags label as Information Disclosure (data associated with the wrong ring) and which could also manifest as instability or DoS. Bottom line: despite the nominal 10.0, this is a low-real-world-priority, hardware-specific reliability/correctness fix, not a widespread exploitable threat. The AV:N and PR:N metrics could not be reconciled with the description and should be verified against the vendor/NVD analysis before being relied upon.

On a host equipped with Marvell OCTEON EP hardware where firmware/platform allocates non-contiguous or non-zero-based MSI-X IRQs, the vDPA interrupt handler routes an incoming interrupt to the wrong virtqueue ring, causing packet/completion data to be processed against another ring's context. In a virtualization deployment this could surface cross-ring data to an unintended consumer or destabilize the datapath. No public exploit is identified at time of analysis, and triggering depends on the specific hardware/IRQ allocation rather than attacker-supplied input.