Linux Vhost Flaw Can Hand Local Users Root Access
The vulnerable path starts when a vhost cache keeps an old address after a virtual ring is reconfigured. On a host, an unprivileged local user with access to a vhost device can use the flaw to read and write kernel memory, then gain root. Under a specific virtualization setup, an untrusted virtual machine can also reach host memory.
Tracked as CVE-2026-74580 and named Vghost, the bug affects Linux kernels from 4.11 through 7.2-rc4. Its CVSS score is 8.8, rated High, with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tencent Zhuque Lab published its technical analysis on October 12 and updated it on October 14. The report describes both host-side privilege escalation and virtual-machine escape. Tencent released a fix on August 3, then published working demonstrations of both attack paths on October 12. There is no public sign that attackers have exploited the flaw.
The flaw affects IOTLB mapping caches for the descriptor, available and used rings in vhost-net and vhost-vsock. Its CVSS rating is 8.8 High, with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
How a stale mapping becomes kernel access
Vhost speeds up network and other input/output operations for virtual machines and containers. A local attacker can reach the vulnerable code through device nodes such as /dev/vhost-net or /dev/vhost-vsock. Tencent says the host-side attack is deterministic: it needs no memory grooming or lucky timing, does not depend on kernel structure layout, and can bypass KASLR to provide arbitrary read and write access to kernel memory.
The bug starts with a stale cache. Vhost stores IOTLB mappings for virtual rings and their shared queues in vq->meta_iotlb[]. But changing a ring's address or size with VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM does not clear that cache. When the kernel finds a cached entry, it treats the newly configured range as if it has already been checked. It can then calculate a new address using the stale mapping, old_map->addr + new_addr - old_map->start, and pass it to raw_copy_to_user() or raw_copy_from_user() without the required range check. That opens the door to a copy beyond the permitted region. The oss-security advisory details the code path.
Two changes created the vulnerable behavior. A 2017 change in Linux 4.11 introduced the cache shortcut. In 2020, a change in Linux 5.9 moved address checking to a later step and removed the check that would have caught the stale translation. Tencent says the vulnerable range runs from Linux 4.11 through 7.2, spanning nearly a decade of kernel development.
Guest escape needs a narrower setup
The guest-to-host attack requires a virtio device behind a virtual IOMMU with iommu_platform enabled. Vhost must run in device-IOTLB mode, and VIRTIO_F_RING_RESET must be available. With those conditions in place, an untrusted guest can trigger an out-of-bounds write in the host kernel that reaches the host's QEMU process heap. Tencent's demonstration shows how a guest could overwrite a QEMU function pointer and redirect execution, or crash the process. A virtual machine without this configuration is not automatically exposed to the escape scenario.
Tencent reproduced the local-user-to-root chain on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0 and Oracle Linux 10.2. Ubuntu restricted the tested device node to the kvm group. On the other four tested images, the node was world-readable with mode 0666. Until the kernel is fixed, administrators should remove world access to /dev/vhost-net and /dev/vhost-vsock, then limit the owning group to trusted virtualization services. The advisory also recommends restricting access to /dev/vhost-scsi and /dev/vhost-vdpa-* and keeping vhost devices away from untrusted containers. On unpatched hosts, do not give untrusted guests vhost devices using iommu_platform behind a virtual IOMMU.
Install a kernel with the fix
Upstream commit de845981da67a6b049080c87e605130b0c30adc5 clears the vring metadata cache in vhost_vring_set_num_addr(), forcing reconfigured addresses through IOTLB validation again. The first fixed upstream stable releases listed are 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Install a kernel containing the fix, then reboot into it. Vendors may backport the change without altering the displayed base version.
Red Hat, Amazon Linux and Oracle Linux have shipped fixes. Ubuntu has fixed 22.04; its 24.04 and 26.04 kernels were still listed as in progress on October 13. Ubuntu, RHEL, Amazon Linux, Azure Linux and Oracle Linux are among the affected distributions, so administrators should check the specific vendor package for patch status. There is no interim workaround for the guest-to-host attack.
Ubuntu's kernel security response is separate from its 26.10 beta coverage of the Coreutils transition to Rust in this Linux release report. Tencent says Corvus AI discovered the flaw in two hours. The lab used Tencent Hunyuan Hy4-preview to check the exploit and validate the fix, and prepared working demonstrations of both the local privilege-escalation and guest-to-host paths. Vghost was found with help from Corvus AI, Tencent's multi-agent system for kernel vulnerability research. The upstream fix credits the system as assisted-by. This was machine-assisted vulnerability research, not an AI-run attack.
Severity assessments differ. The kernel.org CVE team scores the flaw 8.8 and marks its scope as changed. Red Hat scores it 7.3, with unchanged scope and lower integrity impact. Amazon scores it 7.8; Oracle gives it 7.3. Tencent's team and research pipeline also found an 18-year-old SCTP kernel flaw disclosed in August that reached root and escaped a container in testing.
The Tencent Zhuque Lab analysis and the October 14 oss-security advisory describe the vulnerability and mitigation. The definitive remediation is to install a kernel with the upstream fix or a vendor backport, then reboot into that kernel.
