Linux Kernel CVE-2026-74311

Exploitation requires three concurrent conditions: (1) a virtio-rtc device must be exposed to the guest VM - this is a specific virtual device, not universally present in all VM configurations; (2) the guest must enter a freeze/restore cycle (system suspend or hibernation); and (3) virtqueue reinitialization in viortc_restore() must encounter a failure during the error path of vp_find_vqs_msix(), or an unsuccessful intermediate attempt before a later attempt succeeds. The low-privilege requirement (PR:L per CVSS) implies a local unprivileged guest user must be able to initiate or influence the suspend/resume operation; in practice triggering this on demand may require elevated guest permissions depending on the OS policy. The failure mode is constrained to the guest kernel (S:U scope), and the host hypervisor is not affected. Exploitation is further limited by the relative rarity of virtio-rtc device configurations and the requirement for a race condition during power state transitions.

The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity with High impact across all three CIA pillars. The C:H and I:H ratings imply arbitrary kernel code execution potential beyond a simple crash, which is plausible for a NULL dereference in kernel context but is not confirmed by the description - the described impact is specifically a guest kernel panic during restore. AC:L also appears generous since the vulnerability requires both a virtio RTC device to be present and the error path to be triggered during reinitialization failure, which is an uncommon event. EPSS of 0.17% at the 6th percentile strongly signals that exploitation is not occurring at scale and the attack surface is narrow. KEV status is absent from the input, confirming no known active exploitation. The vulnerability does not cross guest-to-host boundaries (S:U), limiting blast radius to the affected guest VM. Real-world risk is primarily guest availability loss (kernel panic during restore), not code execution; prioritization should be moderate, particularly for environments with virtio-rtc-enabled VMs subject to suspend/resume operations.

An attacker with local low-privileged access to a guest VM configured with a virtio-rtc device triggers a system suspend/resume cycle, either by manipulating power management interfaces or by waiting for a legitimate administrative operation. If the virtqueue reinitialization in vp_find_vqs_msix() encounters a transient error or resource constraint during restore, the virtio-pci error path invokes vp_del_vqs() against a mismatched vqs array, dereferencing a NULL pointer and crashing the guest kernel with a kernel panic. No public proof-of-concept exploit code is known at time of analysis.