What is the CVSS score of CVE-2026-74312?

CVE-2026-74312 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74312?

The Linux kernel vhost/vdpa subsystem contains an out-of-bounds memory access vulnerability (CVE-2026-74312, CVSS 7.8) allowing local users with low privileges to crash systems or corrupt kernel…. A patch is available.

How to fix or mitigate CVE-2026-74312?

Within 24 hours, identify and inventory all Linux systems running the vhost/vdpa subsystem (typically VM hosts) and confirm current kernel versions against vendor advisories for active stable branches. Within 7 days, apply the released kernel patches to all affected systems according to your change management process, prioritizing production virtualization hosts and cloud infrastructure. Within 30 days, complete post-patch validation testing and verify all systems are running patched stable kernel versions; retire any unpatched systems from service.

Linux Kernel CVE-2026-74312

EUVD-2026-59459 HIGH

2026-08-15 Linux

GHSA-vx5g-7fcv-7h84

Denial Of Service Linux Red Hat

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only vector with low privilege required to open vhost-vdpa device; C:H/I:H reflect theoretical kernel OOB impact ceiling though DoS is the most confirmed outcome.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:27 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:58 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vhost/vdpa: validate virtqueue index in mmap and fault paths

vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs.

The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks.

Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location.

From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.

AnalysisAI

Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain low-privilege local shell

Delivery

Access /dev/vhost-vdpa device node

Exploit

Issue mmap() with out-of-range virtqueue pgoff index

Install

Bypass u16-only bounds check in mmap/fault path

Driver get_vq_notification() called with invalid index

Execute

Out-of-bounds kernel memory access

Impact

Kernel panic (DoS) or invalid PFN remap

Recon

Gain low-privilege local shell

Delivery

Access /dev/vhost-vdpa device node

Exploit

Issue mmap() with out-of-range virtqueue pgoff index

Install

Bypass u16-only bounds check in mmap/fault path

Driver get_vq_notification() called with invalid index

Execute

Out-of-bounds kernel memory access

Impact

Kernel panic (DoS) or invalid PFN remap

Vulnerability AssessmentAI

Exploitation	Exploitation requires local access to a Linux system with the vhost_vdpa kernel module loaded and at least one /dev/vhost-vdpa device node present, which in turn requires vDPA-capable hardware or a vDPA software emulator to be configured. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is the vendor-assigned score, but the C:H and I:H ratings are theoretical upper bounds - the bug description itself characterizes crash/DoS as the most defensible impact, and a confirmed privilege escalation or data exfiltration path has not been demonstrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with low-privilege access to a KVM or vDPA-backed virtualization host opens a /dev/vhost-vdpa device node and calls mmap() with a vm_pgoff value encoding a virtqueue index greater than the driver's configured v->nvqs count. The missing bounds check in vhost_vdpa_mmap() passes the out-of-range index directly to the driver's get_vq_notification() callback, triggering an out-of-bounds kernel memory access that either panics the host (DoS, crashing all hosted VMs) or remaps an invalid PFN into the attacker's address space. …
Remediation	Upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5, as documented in EUVD-2026-59459 (https://nvd.nist.gov/vuln/detail/CVE-2026-74312) and the upstream stable commits at git.kernel.org. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all Linux systems running the vhost/vdpa subsystem (typically VM hosts) and confirm current kernel versions against vendor advisories for active stable branches. …

Threat intelligence, references, and detailed analysis are available after sign-in.