The vulnerability (CVE-2026-74614) in the Linux kernel's vsock/virtio subsystem was introduced by commit bd50c5dc182b, which changed the handling of *_run flags during device suspend/resume. Worker threads (RX, TX, and event workers) read virtqueues before acquiring locks and checking run flags, which could cause them to access replacement virtqueues' running state while still holding pointers to deleted queues. The patch modifies the code to read each virtqueue under its mutex after verifying the run flag, ensuring pointer and state consistency within the same queue generation.

The vulnerability could lead to worker threads accessing stale or deleted virtqueue pointers, potentially causing undefined behavior or kernel instability. No information about exploitation in the wild or specific impacts such as privilege escalation or denial of service is provided.

A fix has been implemented in the Linux kernel to address this issue by adding proper locking when reading virtqueues. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.