Look up another CVE ยท open CVE-2026-74309 in the interactive tracker
CVE-2026-74309
vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/vdpa. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74309 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Look up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs[0] is not the base.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/vdpa/octeon_ep/octep_vdpa_main.c
- What this is
- MARVELL OCTEON ENDPOINT VIRTIO DATA PATH ACCELERATORMAINTAINERS section matched on drivers/vdpa/octeon_ep/
Check it on the machine
grep -wE 'CONFIG_OCTEONEP_VDPA|CONFIG_VDPA' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_OCTEONEP_VDPA, CONFIG_VDPA
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 10.0 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.65%, higher than 50.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/vdpa
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.14 | 6.18.40 | 3ef0cfa77a3d |
| 6.14 | 7.1.5 | c6c7eae5de79 |
| 6.14 | 7.2 | 0d21a1d6375a |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is in octep_vdpa_intr_handler, entered when the Octeon vDPA virtio-net device raises MSI-X on queue activity; remote or guest-originated network traffic to an internet-facing VM/container backed by this hardware reliably drives that interrupt path on the host.
- AC:LAttack complexity, low
- Once the vDPA device is active, Linux commonly assigns non-contiguous MSI-X Linux IRQ numbers, so the irq-irqs[0] miscalculation occurs automatically; an attacker only needs to send traffic to generate interrupts without influencing timing or layout.
- PR:NPrivileges required, none
- Exploitation requires no host credentials: an unauthenticated remote attacker can trigger the handler by sending packets to a virtio-net endpoint already provisioned on Marvell Octeon vDPA hardware, without CAP_NET_ADMIN, root, or vDPA management access.
- UI:NUser interaction, none
- No victim interaction is required beyond normal automated network I/O to the exposed virtio-net interface; the attacker does not need the administrator or user to mount devices, click links, or perform any manual action.
- S:CScope, changed
- In the primary cloud/KVM deployment, guest or remote network traffic crosses the VM/host boundary to corrupt host kernel memory in the vDPA driver interrupt handler, enabling host compromise from tenant or external network reachability rather than staying within the guest security authority.
- C:HConfidentiality impact, high
- Incorrect ring indexing can yield negative or out-of-bounds vqs[] indices, causing kernel heap reads via ioread8 on attacker-influenced or adjacent cb_notify_addr pointers and disclosure of surrounding kernel memory contents.
- I:HIntegrity impact, high
- The same out-of-bounds vqs[] access performs iowrite8 acknowledgements to wrong MMIO addresses and may invoke corrupted vqs[i].cb.callback function pointers, providing memory corruption primitives suitable for control-flow hijacking in interrupt context.
- A:HAvailability impact, high
- Invalid indices lead to bad MMIO accesses and calls through corrupted callback pointers in hardirq context, which can immediately oops or panic the host kernel and deny service to all tenants on the machine.