A flaw in Linux’s vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host’s memory and hijack the program that runs the virtual machine.

The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the flaw, released a fix on August 3 and published a full write-up on October 12 with working demos of both attacks. There is no public sign it has been exploited yet.

vhost is the part of the Linux kernel that speeds up network and other input/output for virtual machines and containers. A local user reaches it by opening a device node, usually /dev/vhost-net or /dev/vhost-vsock.

On the host, the flaw gives an unprivileged user a reliable way to read and write any kernel address, bypass KASLR, and escalate to root. The attack is deterministic: it needs no memory grooming and no lucky timing.

The second attack is narrower. When a virtual machine’s virtio device is placed behind a virtual IOMMU with iommu_platform turned on, and vhost runs in device-IOTLB mode, an untrusted guest can trigger the same bug and make the host kernel write out of bounds into the host’s QEMU process. From there, a guest can overwrite a function pointer in QEMU and take control of where the host process runs next, or crash it.

How it works

vhost keeps a small cache of the memory mappings behind each virtual ring and the shared queues it uses to move data. A cache hit is treated as proof that the region was already checked. The cache is cleared when the mapping is updated or invalidated and when the queue is reset, but not when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands change the ring’s addresses or size while the queue is live.

With a device IOTLB attached, those commands accept the new addresses without checking them, leaving that check for later. Once the cache is filled, the subsequent check never runs, and vhost continues translating new addresses using the old mapping. The kernel then copies data to or from that pointer without a bounds check, so a write to the used ring or a read of a descriptor lands outside the mapped region. That gives the attacker kernel read and write.

The flaw sat in the code for about nine years because it took two reasonable changes to create it. A 2017 change (Linux 4.11) added the cache and its shortcut. A 2020 change (Linux 5.9) moved address checking out of the command and into a later step, removing the check that would otherwise have caught the stale translation.

Who is affected, and what to do

The flaw affects Linux kernels from 4.11 up to 7.2-rc4. Tencent reproduced the full local-user-to-root chain on five distribution kernels: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On Ubuntu, the device node was limited to the kvm group, so the starting point there was a member of that group rather than any user.

On the other four tested images, the node was world-readable at mode 0666, so any local user could reach it.

The fix (commit de845981da67) clears the cache whenever the ring is reconfigured. Install a kernel that contains it and reboot. The first fixed upstream stable releases are listed below; vendors may also backport the fix without changing their version number.

Red Hat, Amazon Linux, and Oracle Linux have shipped fixes. Ubuntu has fixed 22.04 and, as of October 13, still lists its 24.04 and 26.04 kernels as in progress.

Until a fixed kernel is in place, restrict access to the vhost device nodes. Remove world access to /dev/vhost-net and /dev/vhost-vsock, limit the owning group to trusted virtualization services, and treat membership in that group as a privilege while the vulnerable kernel is running.

There is no interim workaround for the guest-to-host escape; for that path, the patched kernel is the only remedy.

The severity, and the AI finder

The flaw is rated high, not critical, and the raters disagree on how high. The kernel.org CVE team scores it 8.8 and marks its scope as changed, because the guest-to-host write reaches memory in the host’s QEMU process and crosses the boundary between a guest and its host.

Red Hat scores it at 7.3 and marks the scope as unchanged, treating the impact as remaining within the host’s own trust boundary; it also rates the integrity impact lower. Amazon scored it 7.8 and Oracle 7.3.

The bug was found with help from Corvus AI, a multi-agent system Tencent built for kernel vulnerability research. The upstream fix credits it with an Assisted-by line, and Tencent says the pipeline found the flaw.

This is machine-assisted research, not an attack run by AI. It is the same team and pipeline behind an 18-year-old SCTP kernel flaw disclosed in August, which also reached root and, in testing, escaped a container.