CVE-2026-74356

This vulnerability represents a semantic correctness drift that occurred incrementally through refactoring rather than being introduced as a single error. The function `vhost_get_avail_idx` acquired flawed semantics through two commits: one introduced a comparison against `vq->last_avail_idx` in the notification enable path, and a subsequent commit propagated this semantic error when extracting and unifying the comparison logic. Neither commit, standing alone, would have obviously broken the contract — the bug only emerges from their combined effect, which made it invisible to standard code review. The livelock mechanism is a distributed systems deadlock, not memory corruption. When mergeable buffers are enabled and incoming packets don't fit the available descriptor chain, the guest driver intentionally leaves entries in the available ring while re-enabling notifications — a deliberate virtio flow control choice. The host's incorrect reading of "all consumed" causes it to immediately disable notifications again, trapping both sides in a retry loop. The guest can't make progress because notifications are disabled; the host can't notice because it's reading the wrong condition. This is not an isolated incident. The vhost layer has a documented history of protocol synchronization bugs stemming from the same root cause: performance-oriented caching that introduced semantic drift across the virtio boundary. CVE-2020-29479, CVE-2019-3900, and CVE-2017-11089 all share structural kinship with this pattern — each patched in isolation while the underlying institutional failure went unaddressed. The fix of making `vhost_get_avail_idx` match its comment is correct but surgical; it doesn't address the systemic pattern of treating the virtio interface as an optimization target rather than a protocol boundary to preserve. The question worth pressing is whether other functions in this subsystem carry similar undocumented assumptions that have not yet manifested as observable failures. The livelock condition requires specific guest behavior — mergeable buffers, undersized descriptor chains, notification re-enablement — that existing test harnesses don't systematically exercise. That this vulnerability existed for approximately 8-9 years before detection suggests the exposure window for similar latent semantic drift in other functions may be substantial.

Reviewed through automated stages and approved by a human before publication.