A full write-up and public exploit for Vghost, a Linux kernel flaw tracked as CVE-2026-74580, give a local user root access and open a path for a guest virtual machine to attack its host. The bug affects the kernel’s vhost subsystem across versions 4.11 through 7.2-rc4.
Vghost Turns a Stale Cache Into Arbitrary Kernel Memory Access
Tencent Zhuque Lab found the flaw. Credit goes to Fourie Zhang of the TencentOS Security Team together with Corvus AI, which some reports describe as AI-found. A stale address-translation cache in vhost lets a local user read and write kernel memory at will, bypass KASLR and become root. The attack is deterministic and needs no memory grooming.
A Second Path From Guest to Host
A second path targets virtualization. An untrusted virtual machine behind a virtual IOMMU, with iommu_platform on and vhost in device-IOTLB mode, can make the host kernel write out of bounds into the host’s QEMU process. That enables control-flow hijack or a crash. There is no interim workaround for the guest-to-host path.
Two Kernel Changes Nine Years Apart Created the Bug
The root cause traces to two changes. A 2017 change in Linux 4.11 added the cache shortcut, and a 2020 change in Linux 5.9 removed the check that would have caught stale translations. The fix, commit de845981da67, clears the cache when ring addresses or size change. It was released on August 3, and the full write-up and exploit followed on October 12.
Device Permissions Decide Who Can Reach the Bug
On the RHEL, Amazon Linux, Azure Linux and Oracle Linux test images, /dev/vhost-net and /dev/vhost-vsock are mode 0666, which means any local user can reach them. On Ubuntu, access is limited to the kvm group. The researchers reproduced the full chain on five distributions.
Distribution Status and Severity Ratings Differ
Affected products include RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0, Oracle Linux 10.2 and Ubuntu. Red Hat, Amazon Linux and Oracle Linux have shipped fixes. Ubuntu 22.04 is fixed, while fixes for 24.04 and 26.04 were still in progress as of October 13.
Severity scores disagree. The kernel.org CVE team rates the flaw 8.8, with changed scope, and Red Hat rates it 7.3, with unchanged scope. There is no public sign of exploitation yet.
Guidance Until Patches Land
The remedy is to install a patched kernel and reboot. Until a fix is available, administrators can remove world access to the vhost device nodes, which closes the local path on systems where those nodes are open to all users. That step does not cover the guest-to-host route, for which no workaround exists.
The gap between the August 3 fix and the October 12 publication shows how long distribution backports can take. Ubuntu 24.04 and 26.04 remained unfixed when the exploit became public, which leaves hosts running them exposed to anyone in the kvm group and to guests that meet the IOMMU conditions. Cloud and virtualization hosts are the most exposed because they combine many untrusted tenants with the exact subsystem the bug lives in. The span of affected kernels, from 4.11 through 7.2-rc4, covers roughly nine years of releases, and the sources do not say how many systems run them.
Two Scoring Models for One Flaw
The disagreement between kernel.org’s 8.8 and Red Hat’s 7.3 comes down to scope. The kernel.org CVE team scores the flaw with a changed scope, while Red Hat scores it with scope unchanged. Administrators who sort their patch queues by CVSS will therefore see a different priority depending on which score their tooling reads, even though the bug and the public exploit are the same.
