Linux Kernel CVE-2026-74356

Exploitation requires the Linux kernel vhost-net subsystem to be actively in use - specifically KVM or QEMU-KVM virtualization with a virtio-net device using the in-kernel vhost backend. The mergeable receive buffer feature (VIRTIO_NET_F_MRG_RXBUF) must be negotiated between host and guest; this is commonly enabled in modern virtio-net configurations but is not universal and is absent when guests use legacy virtio or when the feature is explicitly disabled in the hypervisor configuration. The guest must enter a state where it is not consuming virtio ring entries fast enough relative to incoming packet arrival - this can happen under guest load or can be induced by a guest VM under attacker control. Bare-metal Linux systems, containers, and virtualized guests using emulated (non-virtio) network devices are unaffected. The impact is limited strictly to availability (livelock/DoS on the host vhost thread); there is no confidentiality or integrity impact.

The official CVSS 7.4 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) accurately conveys the cross-boundary availability impact but the AC:L rating may overstate exploitability: triggering the livelock requires mergeable receive buffers to be negotiated and the guest to be in a stalled state, conditions that together argue for AC:H rather than AC:L. EPSS at 0.17% (6th percentile) is consistent with the absence of both CISA KEV listing and any public proof-of-concept code, indicating low likelihood of opportunistic exploitation at this time. The S:C (Scope Changed) metric is the most operationally significant signal, confirming that a defect in the guest-side I/O path can livelock a host kernel thread and cross the virtualization boundary - a meaningful concern for dense KVM fleets in cloud and service-provider settings; even a mid-sized municipal IT team in opole operating KVM virtualization with virtio-net should treat this as a priority patch if mergeable buffers are in use, since a stalled or deliberately misbehaving guest VM can reliably trigger the condition. The 'Information Disclosure' tag present in the intelligence feed is not supported by the CVE description or CVSS metrics and appears to be a misclassification - the actual impact is purely availability.

An attacker operating a guest VM - or influencing one via adjacent network access - sends a stream of packets whose combined size exceeds available virtio ring buffer entries while the guest process is slow or stalled in consuming those entries. With mergeable buffers negotiated, vhost-net attempts to re-enable guest notifications, but vhost_get_avail_idx returns the wrong value, causing vhost_enable_notify to immediately disable notifications and retry in a tight loop, livelocking the host CPU thread servicing that guest's network I/O. No public proof-of-concept exploit has been identified at time of analysis.