Linux kernel 'Vghost' CVE-2026-74580 (CVSS 8.8 kernel.org, 7.3 Red Hat): stale vhost cache gives local users root on kernels 4.11 to 7.2-rc4 and, with a virtual IOMMU, lets a guest write into host QEMU; found with Tencent's Corvus AI, fix upstream since August

Tencent Zhuque Lab published a full write-up and working demos on 12 October 2026 for CVE-2026-74580, which it calls Vghost. The bug is in the Linux kernel's vhost subsystem, which accelerates network and other I/O for virtual machines and containers through device nodes such as /dev/vhost-net and /dev/vhost-vsock. vhost caches the memory mapping behind each virtual ring and treats a cache hit as proof the region was already checked, but the cache was not cleared when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands changed a live ring's addresses or size. With a device IOTLB attached, the old mapping keeps being used and the kernel copies data outside the mapped region. On a host this gives a local user deterministic arbitrary kernel read and write, a KASLR bypass and root, with no heap grooming or race. Where a guest's virtio device sits behind a virtual IOMMU with iommu_platform on, an untrusted guest can trigger the same bug to make the host kernel write out of bounds into the host's QEMU process, which can be used to hijack or crash it. Tencent reproduced local-user-to-root on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2; on Ubuntu the node is limited to the kvm group, but on the other four it was world-accessible (mode 0666). The flaw dates from a 2017 change (Linux 4.11) combined with a 2020 change (5.9). The kernel.org CNA scores it 8.8 with scope changed; Red Hat scores 7.3 (scope unchanged), Amazon 7.8 and Oracle 7.3. Tencent says its Corvus AI multi-agent system found the bug; the fix (commit de845981da67) was released on 3 August and credits it with an Assisted-by line. No exploitation is reported. Primary: Tencent Zhuque Lab write-up and the upstream kernel commit; The Hacker News background.

Product

Linux kernel vhost subsystem (vhost-net, vhost-vsock) on KVM/QEMU hosts and container hosts

Versions

Linux 4.11 through 7.2-rc4. First fixed stable releases: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Red Hat, Amazon Linux and Oracle Linux have shipped fixes; Ubuntu has fixed 22.04 and, as of 13 October, still lists 24.04 and 26.04 as in progress.

CVSS

8.8 (CVSS 3.1, kernel.org CNA); Red Hat 7.3

Exploited in Australia?

unknown

Patch to

Install a distribution kernel that contains commit de845981da67 (or upstream 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2 or later) and reboot. Until then, remove world access to /dev/vhost-net and /dev/vhost-vsock, limit the owning group to trusted virtualisation services, and treat that group as privileged. There is no workaround for the guest-to-host path, so patch KVM hosts running untrusted guests with a virtual IOMMU first.

Primary: Tencent Zhuque Lab — Vghost: Beyond the Privilege Boundary (CVE-2026-74580, 12 Oct 2026) · Vendor: Linux kernel — commit de845981da67: vhost: reset the vring metadata cache on vring reconfiguration · CVE: CVE-2026-74580 · Red Hat — CVE-2026-74580 (Important, CVSS 3.1 7.3)

vulnerabilities cloud