CVE-2026-74742 veth: fix queue index used to wake the peer txq in veth_poll
A logic error in the Linux kernel veth driver causes network queue stalls in multi-queue setups without XDP, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74742?
CVE-2026-74742 is a high-severity denial of service vulnerability in Linux, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
veth: fix queue index used to wake the peer txq in veth_poll
veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so queue_index stays 0 for every queue, as priv->rq is zero-allocated.
So in a multi-queue setup with GRO enabled and no XDP program attached, every NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops peer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing ever wakes it again: the poller draining queue 1 wakes queue 0 instead. veth implements no ndo_tx_timeout, so the netdev watchdog does not kick in either, and the queue stays stopped indefinitely.
Derive the index from the position of the rq within priv->rq instead, which is correct regardless of whether XDP was ever enabled.
Scripts to reproduce the stall are available at https://github.com/netoptimizer/veth-backpressure-performance-testing
Which versions are affected by CVE-2026-74742?
How do I fix CVE-2026-74742?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74742 being exploited?
There is no known exploitation of CVE-2026-74742 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74742, DEBIAN-CVE-2026-74742, GHSA-pp8f-5mj5-qp78, UBUNTU-CVE-2026-74742.