Junglewise Threat Intelligence

CVE-2026-74742: Linux kernel veth queue index bug in GRO mode

CVE-2026-74742 · Severity: high · CVSS 7.5 · Published 2026-08-26

Executive brief

The Linux kernel's virtual Ethernet driver (veth) has a networking queue handling bug that can cause indefinite transmission stalls in multi-queue systems when GRO (Generic Receive Offload) is enabled without an XDP program. When one transmission queue becomes congested, the polling mechanism incorrectly signals queue 0 instead of the actual congested queue, preventing traffic from resuming and effectively freezing network performance on that queue.

Technical details

The vulnerability is a logic error in the veth_poll() function where the queue index used to wake the peer transmit queue is derived from rq->xdp_rxq.queue_index, which is only initialized when XDP programs are attached. In GRO-only mode (veth_napi_enable_range()), this field remains 0 for all queues due to zero-allocation of priv->rq. In multi-queue setups, when veth_xmit() stops a peer TX queue (e.g., queue 1) due to ptr_ring exhaustion, the NAPI poller incorrectly wakes queue 0 instead, leaving the congested queue in a stopped state indefinitely. Since veth lacks an ndo_tx_timeout handler, the netdev watchdog cannot recover the queue. The fix derives the queue index from the offset of rq within priv->rq, which is reliable regardless of XDP enablement status. The vulnerable code path requires multi-queue configuration and GRO enabled without XDP, affecting Linux kernels from 4.9 onward (since commit dc82a33297fc).

Affected products

  • Linux Linux kernel 4.9 and later

Timeline

  • 2026-08-26: disclosed: Published on NVD
  • 2026-08-10: patched: Fix merged by Jakub Kicinski (commit 60db47f02bfa2aa688938aa199117ec4f8e31d23)
  • 2026-08-06: other: Patch authored by Jonas Köppeler

References

Related threats