EUVD-2026-59456
GHSA-mxhm-35m8-cqc9
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Reachable only locally on specific OCTEON EP hardware with an unusual IRQ layout (AV:L/AC:H), needs local device/datapath access (PR:L); impact is limited cross-ring data exposure and instability (C:L/A:L).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
Look up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs[0] is not the base.
AnalysisAI
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to run the Linux kernel vdpa/octeon_ep driver on Marvell OCTEON EP hardware with the vDPA datapath active, AND the platform must assign IRQs that are non-contiguous or whose base is not irqs[0] - on systems with contiguous zero-based IRQ allocation the buggy arithmetic produces the correct index and the flaw does not manifest. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host equipped with Marvell OCTEON EP hardware where firmware/platform allocates non-contiguous or non-zero-based MSI-X IRQs, the vDPA interrupt handler routes an incoming interrupt to the wrong virtqueue ring, causing packet/completion data to be processed against another ring's context. In a virtualization deployment this could surface cross-ring data to an unintended consumer or destabilize the datapath. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 6.18.40, 7.1.5, or 7.2-rc1 (or later) - or apply the upstream fix commits 3ef0cfa77a3d526591be069850d186c255e3f0cc, c6c7eae5de798442987619434171ac886035d57c, or 0d21a1d6375a05274291e32c1ab7cd57dbb69513 from git.kernel.org/stable, referenced via https://nvd.nist.gov/vuln/detail/CVE-2026-74309. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit infrastructure to identify any Marvell OCTEON EP devices using the vDPA data path, as only these systems are vulnerable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today