Nine-year-old Linux kernel flaw Vghost grants root and can enable VM escape

A flaw that sat in the Linux kernel's vhost subsystem for roughly nine years can let an unprivileged local user gain root on several major distributions and, in a narrower configuration, let a virtual machine guest attack its host, according to The Hacker News. Tracked as CVE-2026-74580 and nicknamed "Vghost", the bug affects kernels from 4.11 up to 7.2-rc4. Tencent Zhuque Lab, which found it, published a full write-up with working demos of both attacks on October 12. The upstream fix was released on August 3, the publication reported.

What happened

vhost accelerates network and other I/O for virtual machines and containers, and local users reach it through device nodes such as /dev/vhost-net and /dev/vhost-vsock. According to The Hacker News, vhost caches the memory mappings behind each virtual ring and treats a cache hit as proof that the region was already validated. The cache is cleared on several events but not when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands change a live ring's addresses or size. With a device IOTLB attached, new addresses are then translated through a stale mapping and data is copied without a bounds check.

The report traces the issue to a 2017 change in Linux 4.11 that introduced the cache and a 2020 change in Linux 5.9 that moved the address check that would otherwise have caught the stale translation.

Technical details

The Hacker News said the local attack lets an unprivileged user read and write any kernel address, bypass KASLR and escalate to root, and described it as deterministic, needing no memory grooming or timing luck. Tencent reproduced the full chain on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0 and Oracle Linux 10.2. On all but Ubuntu, the vhost device nodes were world-accessible (0666) in the tests; on Ubuntu, access was limited to the kvm group.

The guest-to-host path is narrower. It applies when a VM's virtio device sits behind a virtual IOMMU with iommu_platform enabled and vhost runs in device-IOTLB mode. In that case an untrusted guest can trigger an out-of-bounds write from the host kernel into the host's QEMU process, which could be used to redirect execution or crash the process.

Scores differ between raters: the kernel.org CVE team assigned 8.8, Amazon 7.8, and Red Hat and Oracle 7.3. The bug was found with Corvus AI, a multi-agent system Tencent built for kernel vulnerability research; the publication stressed this was machine-assisted research, not an attack carried out by AI.

Who is affected

According to the report, Red Hat, Amazon Linux and Oracle Linux have shipped fixes, and Ubuntu has fixed 22.04, while its 24.04 and 26.04 kernels were still listed as in progress as of October 13. First fixed upstream stable releases include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Vendors may backport the fix without changing version numbers. There is no public sign of exploitation so far.

What to do

The primary remedy is to install a fixed kernel and reboot. Until then, The Hacker News advises removing world access to /dev/vhost-net and /dev/vhost-vsock, limiting the owning group to trusted virtualization services and treating membership in that group as a privilege. There is no interim workaround for the guest-to-host escape; for that path, only the patched kernel helps. Hosts running untrusted multi-tenant workloads should prioritize the update.