CVE-2026-74713: Linux Kernel vhost_iotlb DOS Vulnerability

CVE-2026-74713 Overview

CVE-2026-74713 is a Linux kernel vulnerability in the vhost_iotlb subsystem. The flaw resides in vhost_iotlb_add_range_ctx(), which only retires old entries when the table has a non-zero limit, has exactly reached that limit, and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables continue allocating entries after reaching their configured limit. A local attacker with the ability to issue IOTLB updates from userspace or a guest can force unbounded GFP_ATOMIC allocations, exhausting kernel memory and causing denial of service.

Critical Impact
A local, unauthenticated attacker can trigger unbounded kernel memory allocation through repeated IOTLB updates, resulting in high-availability impact on the host system.

Affected Products

Linux kernel vhost_iotlb common helper
Linux kernel vhost-vDPA and VDUSE paths
Linux kernel mlx5 vDPA and vdpa_sim drivers

Discovery Timeline

2026-08-22 - CVE-2026-74713 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74713

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw in the shared vhost IOTLB helper used by multiple vDPA and vhost drivers. vhost_iotlb_add_range_ctx() enforces its per-table entry cap only when the retire flag is set and the current count exactly matches the configured limit. Any IOTLB instance created without VHOST_IOTLB_FLAG_RETIRE, or without a positive limit, treats new insertions as unbounded. Existing vhost devices allocate IOTLBs using max_iotlb_entries from vhost.c, which defaults to 2048 and is tunable by module parameter, but downstream drivers such as mlx5 vDPA, VDUSE, and vhost-vDPA did not propagate a caller-side limit into the common helper.

Root Cause

The defect is a missing bound check on the map allocation path [CWE-770: Allocation of Resources Without Limits or Throttling]. The helper conflates "retire on full" semantics with "enforce a hard cap." When the retire flag is not set, the code takes the allocation path unconditionally, calling kmalloc with GFP_ATOMIC for each new range. Guest-controlled or userspace-controlled update streams can therefore drive the IOTLB size beyond any intended ceiling.

Attack Vector

Exploitation requires local access with the ability to submit IOTLB updates. This includes an untrusted userspace process interacting with /dev/vhost-vdpa* or a VDUSE control device, or a guest issuing address-translation updates through a vhost-backed virtio device. By repeatedly registering new IOVA ranges without triggering retirement, the attacker forces the kernel to keep allocating map nodes until memory pressure induces a denial of service on the host. See the kernel commit 1ed35ac and kernel commit ae128dd1 for the corrective changes.

The vulnerability manifests in the IOTLB add-range path. Refer to the upstream commits for the exact code changes.

Detection Methods for CVE-2026-74713

Indicators of Compromise

Sustained growth of kernel slab memory associated with vhost_iotlb map nodes on hosts running vDPA, VDUSE, or vhost-vDPA workloads.
Repeated GFP_ATOMIC allocation failures or OOM messages in dmesg originating from vhost or vDPA call stacks.
Guest or userspace processes issuing high volumes of IOTLB update ioctls against /dev/vhost-vdpa* or VDUSE devices.

Detection Strategies

Monitor /proc/slabinfo for anomalous growth in kmalloc caches on hypervisor hosts that expose vDPA or VDUSE to guests.
Audit kernel logs for OOM-killer activity correlated with vhost or vDPA processes.
Track ioctl call rates against vhost-vDPA and VDUSE character devices to identify abusive update patterns.

Monitoring Recommendations

Enable eBPF-based tracing of vhost_iotlb_add_range_ctx invocations on kernels that have not yet been patched.
Alert on host memory pressure events on virtualization hosts running untrusted guests with paravirtualized I/O.
Correlate guest lifecycle events with host slab allocation trends to identify tenants driving IOTLB growth.

How to Mitigate CVE-2026-74713

Immediate Actions Required

Apply the upstream fixes referenced in kernel commit 1ed35ac and kernel commit ae128dd1 or upgrade to a distribution kernel that includes them.
Restrict access to /dev/vhost-vdpa* and VDUSE control devices to trusted administrators only.
Audit hypervisor hosts that expose vDPA to guests and confirm entry limits are configured on all IOTLB consumers.

Patch Information

The upstream fix uses the caller-provided limit at the allocation point, rejects non-positive values in vhost paths that can report an error, and adds max_iotlb_entries parameters for mlx5 vDPA, VDUSE, and vhost-vDPA. Full-range mappings are now validated to fit both split entries before the first half is inserted. When a retiring table is full, the retired map node is reused instead of freed and reallocated. Non-retiring tables return -ENOSPC when full, and zero-limit tables reaching the common helper return -EINVAL.

Workarounds

Disable or unload the vhost_vdpa, vduse, and related vDPA driver modules on hosts that do not require them.
Reduce the max_iotlb_entries module parameter on vhost where operationally acceptable to lower the ceiling of any abuse window.
Isolate untrusted guests on hosts without vDPA or VDUSE exposure until patches are deployed.

bash

# Verify running kernel and reload vhost with a lower entry cap
uname -r
modinfo vhost | grep max_iotlb_entries
sudo modprobe -r vhost_vdpa vduse vhost
sudo modprobe vhost max_iotlb_entries=512