Skip to content
Hacker Posts

Linux vhost bug CVE-2026-74580 gives local root and a VM escape

CVE-2026-74580, a stale-cache flaw in the Linux kernel's vhost subsystem, gives local users root and — with a virtual IOMMU — lets a guest write into the host. Patched.

Published 3 min read
cvelinuxkernelvirtualization

A flaw in the Linux kernel's vhost subsystem, CVE-2026-74580, lets a local user escalate to root, and — in a configuration using a virtual IOMMU — lets an untrusted guest write out of bounds into the host's hypervisor process. The kernel CVE team scores it 8.8 (CVSS 3.1, scope changed). It's patched across stable branches. If you run multi-tenant virtualization on Linux or let untrusted users reach /dev/vhost-*, patch.

The primary sources are the kernel.org CVE record and the October 14 oss-security disclosure; reporting and the vendor-score spread are at The Hacker News.

What the bug does

vhost caches the IOTLB mapping for each vring's metadata region in vq->meta_iotlb[], and iotlb_access_ok() treats a cache hit as proof the mapping was already validated. The cache is reset on several IOTLB and vq-reset events — but not when VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM reconfigures the vring. The stale entry is then reused, so the kernel translates addresses through an old mapping that no longer covers them, and the copy helpers don't recheck the result. Later used-ring updates or descriptor fetches read or write outside the mapped region.

Two impacts follow:

  • Local root. A local user reaching vhost character devices (/dev/vhost-net, /dev/vhost-vsock) gets arbitrary kernel-memory read/write, bypasses KASLR, and escalates to root. The reporter calls the attack deterministic.
  • Guest-to-host escape. With a virtual IOMMU (iommu_platform on, device-IOTLB mode), an untrusted guest can make the host kernel write out of bounds into the host's QEMU process — overwriting a function pointer to hijack execution, or crashing it. The CVSS scope change reflects exactly this: the blast radius crosses into the VMM process.

The upstream fix credits Tencent's Corvus AI, a multi-agent system for kernel vulnerability research, with an Assisted-by line; Tencent Zhuque Lab published a write-up on October 12. This is machine-assisted research, not an AI-run attack.

Affected and fixed versions

  • Affected: kernels from 4.11 onward (the regression is drivers/vhost/vhost.c). Versions before 4.11 are unaffected.
  • Fixed (stable): 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2.

The fix (commit de845981da67) clears the metadata cache when the ring is reconfigured. Vendor scores differ: Red Hat and Oracle 7.3, Amazon 7.8, kernel.org 8.8. Red Hat, Amazon and Oracle have shipped fixes; Ubuntu patched 22.04, with 24.04 and 26.04 in progress as of October 13. Distros may backport without changing the version string.

Exploitation status

No public sign of exploitation. Tencent published working demos of both the local-root and guest-to-host attacks, and the write-up links a PoC repository — so exploit code exists.

Action checklist

  1. Patch to a fixed stable kernel (list above) or your distro's backport. Confirm the fix by changelog, not version number alone.
  2. Until patched, restrict the vhost devices. Remove world access from /dev/vhost-net and /dev/vhost-vsock and limit the owning group to trusted services — this closes the local-root path.
  3. For the VM escape there is no interim workaround — only the patched kernel fixes hosts running guests with a virtual IOMMU in device-IOTLB mode. Prioritize multi-tenant hosts.

Context

This is the second AI-found memory-safety bug disclosed this week, alongside curl's CVE-2026-92392. vhost's cached-translation fast path has been a recurring source of escape-grade bugs; the pattern — a validation cache that outlives the state it vouches for — is worth grepping your own code for.

Related stories