Linux Kernel ixgbe CVE-2026-74317

All three of the following conditions must be simultaneously present: (1) the target system must be running the Intel E610 series NIC with the ixgbe kernel driver loaded and active; (2) the host must have 64 or more logical CPUs - this is the precise threshold at which XDP queue allocation (one per CPU) exceeds the MSI-X-capped netdev queue count of 63, creating the off-by-one; (3) the attacker must possess CAP_NET_ADMIN capability (or equivalent privileges) sufficient to attach an XDP program to the network interface via ip link or a BPF syscall. Systems with fewer than 64 logical CPUs are structurally not affected regardless of NIC type. Systems using any NIC other than the E610 under the ixgbe driver are not affected. The CAP_NET_ADMIN requirement is a meaningful barrier in hardened environments but is routinely granted to container workloads in Kubernetes deployments without host-level isolation, expanding the exploitable surface in cloud-native data centers.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the potential kernel memory corruption impact accurately but overstates ease of exploitation: AC:L does not reflect the hardware prerequisite (Intel E610 adapter) and CPU-count requirement (≥64 logical CPUs) needed to reach the vulnerable code path. EPSS at 0.15% (5th percentile) confirms very low exploitation probability, consistent with the niche trigger conditions. The CVE is not listed in CISA KEV, and no POC code has been identified at time of analysis. Under the SSVC framework, this would likely classify as 'Track' - no active exploitation, requires specific hardware, but the technical impact (kernel slab-OOB write leading to potential privilege escalation) is high if triggered. The exploitable population is non-trivial in cloud and HPC data centers deploying E610 NICs with high-core-count servers, where XDP is actively used for high-performance networking workloads. The CVSS C:H/I:H/A:H trio is credible given that kernel slab corruption can enable code execution at ring 0 if heap layout is controlled.

A local attacker with CAP_NET_ADMIN on a ≥64-CPU server equipped with an Intel E610 NIC runs 'ip link set dev eth0 xdp obj prog.o' to attach a crafted XDP program, triggering ixgbe_configure_tx_ring() to call netif_set_xps_queue() for XDP queue index 63. The resulting 4-byte slab-out-of-bounds write corrupts adjacent kernel heap metadata; with knowledge of heap layout (e.g., via a kernel info-leak pairing), an attacker could overwrite a function pointer or security-critical structure to escalate privileges to root. No public exploit code has been identified at time of analysis.