Linux kernel vhost: wrong avail-index return value lets a stalled guest livelock the host

Impact

vhost_get_avail_idx() reported whether the ring was fully consumed rather than whether it had updated vq->avail_idx. With vhost-net and mergeable buffers, the driver re-enables notifications while entries remain in the ring; the wrong return value propagates through vhost_enable_notify() so the host immediately disables notifications and retries. If the guest is not making progress, the host livelocks in the vhost worker. The CVSS vector has scope change and availability impact, which matches the exposure: a guest VM burns host CPU and takes down host-side networking for co-resident workloads. On a virtualized GPU fleet that is one tenant VM degrading the hypervisor for every other VM on the node. Introduced by d3bb267bbdcb and carried forward by 7ad472397667.

Who can reach it

A guest with a virtio-net device backed by vhost-net, with mergeable buffers enabled - that is, any tenant VM on the node. No host credentials needed; the guest only has to leave undersized entries in the avail ring and stop making progress.

What to do

Update to a stable kernel where vhost_get_avail_idx() reports new entries (five stable commits are linked; the record names no fixed release). The vhost modules are in use by every running guest, so this is a host kernel update: drain or live-migrate the VMs off the node and reboot. No configuration workaround is described; disabling mergeable buffers on virtio-net is the only knob the record implies, and it is a guest-visible feature change.

References

Related entries

• Linux kernel Tegra241 CMDQV: SMMU probe failure dereferences the freed smmu structCVE-2026-90427 · Linux kernel iommu/tegra241-cmdqv (SMMU devm_krealloc fallback path)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm/vmx): With adaptive PEBS exposed, KVM never guaranteed that LBR MSRs held guest valuesCVE-2024-26992 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel (drivers/gpu/drm/nouveau): When the device-to-host copy behind a page fault silently fails, the faultCVE-2024-50096 · Linux kernel (drivers/gpu/drm/nouveau)High
• Linux kernel (uvcvideo): Out-of-bounds write parsing UVC_VS_UNDEFINED frames - exploited in the wildCVE-2024-53104 · Linux kernel (uvcvideo)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): Kernel-mode flaw in the 800-series Ethernet Linux driver (anCVE-2025-23241 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High