Vghost vhost flaw enables Linux root access and VM host risk
Tencent Zhuque Lab has disclosed CVE-2026-74580, a Linux kernel vhost vulnerability named Vghost that can let a local user read and write arbitrary kernel memory and escalate to root. The issue affects kernels from Linux 4.11 through 7.2-rc4. In a specific virtualisation configuration, an untrusted guest can also cause an out-of-bounds write into the host's QEMU process.
The researchers released a fix on August 3 and published their technical write-up, including working demonstrations of both attack paths, on October 12. There is no public indication that Vghost has been exploited. The upstream change is commit de845981da67, which clears a relevant cache whenever a virtual ring is reconfigured.
Stale mappings undermine vhost checks
vhost is a Linux kernel component used to accelerate networking and other input/output for virtual machines and containers. A local process can normally access it through device nodes such as /dev/vhost-net and /dev/vhost-vsock.
The defect lies in a small cache that stores memory mappings for virtual rings and shared queues. A cache hit is treated as evidence that a memory region has already been validated. The cache is cleared when mappings change or are invalidated, and when a queue is reset, but it was not cleared when live queues had their ring addresses or sizes changed with VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM.
With a device IOTLB attached, those commands accept new addresses while deferring validation. If the cache has already been populated, the deferred check does not run and vhost translates the new addresses through an old mapping. Subsequent kernel copies can then read from or write outside the mapped region, giving the attacker kernel-memory access without memory grooming or timing races.
Guest-to-host path has strict conditions
The virtual-machine scenario requires a virtio device behind a virtual IOMMU with iommu_platform enabled and vhost operating in device-IOTLB mode. Under those conditions, a guest can make the host kernel write beyond bounds into the host QEMU process. That can overwrite a QEMU function pointer and control its next execution location, or crash the process.
This boundary-crossing risk is related to the operational concern illustrated by container-to-host root escalation risks where container-to-host root paths demonstrate why isolation settings and kernel patch levels need separate review.
The vulnerable sequence developed through two changes: Linux 4.11 introduced the cache and its shortcut in 2017, while Linux 5.9 moved address validation from the configuration command into a later operation in 2020. Tencent says Corvus AI, its multi-agent kernel vulnerability research system, assisted the discovery; the upstream fix includes an Assisted-by credit. This was machine-assisted research rather than an AI-driven attack.
Patch and restrict device-node access
Tencent reproduced a local-user-to-root chain on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0 and Oracle Linux 10.2. Ubuntu restricted the relevant device node to the kvm group, whereas the other four tested images exposed it as world-readable mode 0666.
First fixed upstream releases are 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Red Hat, Amazon Linux and Oracle Linux have shipped fixes. Ubuntu has fixed 22.04, while its 24.04 and 26.04 kernels were still listed as in progress as of October 13; vendor backports may not alter version strings.
Organisations should install a kernel containing the fix and reboot. Until then, they should remove world access to vhost device nodes, restrict their owning group to trusted virtualisation services, and treat membership of that group as privileged. The guest-to-host path has no interim workaround, so patching the host kernel is the practical business requirement.