CVE-2026-74713

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost_iotlb: bound map allocation in add_range

vhost_iotlb_add_range_ctx() only retires an old entry when the table

has a non-zero limit, has exactly reached that limit and has

VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating

entries after reaching their configured limit.

Existing vhost devices allocate their IOTLB with max_iotlb_entries from

vhost.c, which defaults to 2048 and is tunable by module parameter. Use

the caller-provided limit at the allocation point instead of adding a

separate default in the common IOTLB helper, and reject non-positive

values in vhost paths that can report an error.

Other vhost IOTLB users should not create zero-limit tables when entries

can be populated from userspace or guest-controlled requests. Add

caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and

vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require

at least two entries for v

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References