Linux Kernel CVE-2026-74713

Exploitation requires the target Linux system to be running one of the affected vhost subsystems (vhost, mlx5 vDPA, VDUSE, or vhost-vDPA) with an active IOTLB table that does not have VHOST_IOTLB_FLAG_RETIRE set (a non-retiring table). The attacker must have the ability to submit IOTLB mapping requests - either as a guest VM communicating via the vDPA/vhost interface, or as a local userspace process with access to a vhost character device. The vulnerability is not reachable on systems where none of these subsystems are loaded or in use. Exploitation is limited by: (1) the requirement for vhost/vDPA subsystem activation, which is non-default on general-purpose Linux installations; (2) the need for sustained high-volume mapping requests to cause meaningful memory pressure; and (3) host-side mitigations such as kernel memory limits and OOM killer heuristics that may terminate the offending process before full exhaustion. Systems without any virtualisation workloads are entirely unaffected.

The official CVSS 3.1 score of 7.1 (High) with vector AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that a guest-level actor (who holds no host privileges) can trigger the flaw locally, causing availability impact that crosses into the host kernel scope. The S:C designation is the most significant risk amplifier: in a multi-tenant virtualisation environment, a single malicious or compromised VM guest can exhaust host kernel memory, potentially causing a denial-of-service condition affecting all co-resident workloads. However, real-world risk is substantially tempered by multiple signals: EPSS is 0.20% at the 10th percentile, there is no known KEV listing, no public exploit code has been identified, and exploitation requires the vhost/vDPA subsystem to be in active use. The PR:N metric reflects the guest perspective (no host credentials required), but successful exploitation still demands the ability to issue IOTLB mapping requests - either as a guest VM or as a local userspace process with vhost device access. The 'Information Disclosure' tag from intelligence sources appears to be a mislabelling; the vulnerability's confirmed impact is availability, not confidentiality. On balance, this is a real but narrow-scope priority: important for hypervisor operators and cloud providers running vhost-enabled Linux hosts, but low urgency for general-purpose Linux deployments without virtualisation workloads.

A malicious or compromised guest VM operating on a Linux host using vhost-vDPA or VDUSE continuously submits IOTLB mapping requests that populate a non-retiring IOTLB table beyond its configured limit. Because the retirement gate is never triggered, the kernel performs unbounded GFP_ATOMIC allocations, progressively exhausting the host kernel's memory pool. With sufficient request volume, this can trigger an out-of-memory condition on the host, crashing or destabilising all co-resident virtual machines and host services. No public exploit code exists, so this scenario would require custom tooling targeting the vhost interface.