Vghost: Linux kernel bug hands local users root and lets a guest break out to the host

Researchers at Tencent Zhuque Lab have disclosed a flaw in the Linux kernel's vhost subsystem, named Vghost and tracked as CVE-2026-74580. It lets a local, unprivileged user read and write any kernel address at will, bypass KASLR, and escalate to root. The attack is deterministic: it needs no memory grooming and no lucky timing.

vhost is the part of the kernel that speeds up network and other I/O for virtual machines and containers. A user reaches it by opening a device node, usually /dev/vhost-net or /dev/vhost-vsock.

Guest-to-host escape

The second scenario is narrower: when a VM's virtio device sits behind a virtual IOMMU with iommu_platform enabled and vhost runs in device-IOTLB mode, an untrusted guest can trigger the same bug and make the host kernel write out of bounds into the host's QEMU process. From there the guest can overwrite a function pointer and seize control of where the host process runs next, or crash it.

How it works

vhost keeps a small cache of the memory mappings behind each virtual ring. A cache hit is treated as proof that the region was already checked. The cache is cleared when a mapping is updated or reset, but not when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands change the ring's addresses or size while it is live. As a result the kernel keeps translating new addresses through the old mapping and copies data without a bounds check.

The flaw lived in the code for about nine years because it took two reasonable changes to create it: a 2017 change (Linux 4.11) added the cache and its shortcut, and a 2020 change (Linux 5.9) moved address checking to a later step, removing the check that would have caught the stale translation.

Who is affected and what to do

Kernels from 4.11 up to 7.2-rc4 are affected. The full local-user-to-root chain was reproduced on five distribution kernels: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On Ubuntu the node is limited to the kvm group; on the other four it was world-readable at mode 0666.

The fix (commit de845981da67) clears the cache whenever the ring is reconfigured; the patch shipped on August 3 and the full write-up appeared on October 12. Red Hat, Amazon, and Oracle have shipped fixes, and Ubuntu has patched 22.04, but as of October 13 its 24.04 and 26.04 kernels are still listed as in progress. Until a fixed kernel is installed, restrict access to the vhost device nodes. There is no interim workaround for the guest-to-host escape—only the patch helps.

Severity and the AI finder

The flaw is rated high, not critical, and the raters disagree: the kernel.org team scores it 8.8 with a changed scope, Red Hat 7.3, Amazon 7.8, and Oracle 7.3.

The bug was found with help from Corvus AI, a multi-agent system Tencent built for kernel vulnerability research; the upstream fix credits it with an Assisted-by line. This is machine-assisted research, not an attack run by AI. The same team previously disclosed an 18-year-old SCTP flaw.

Source: The Hacker News