AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the
A critical flaw in Linux's vhost subsystem allows local users to gain root privileges across numerous kernel versions, starting from 4.11 up to 7.2-rc4. Tencent Zhuque Lab discovered the vulnerability, which they've named Vghost, and released a patch on August 3, with a comprehensive write-up published on October 12. The flaw, tracked as CVE-2026-74580, grants unprivileged users unrestricted access to kernel memory, permitting both reading and writing operations.
This enables attackers to bypass kernel address space layout randomization (KASLR) and escalate privileges to root. The second attack vector involves exploiting virtual machines with virtio devices behind virtual IOMMU, allowing untrusted guests to write out of bounds in the host kernel, potentially hijacking the QEMU process or crashing it.
The vulnerability stems from a cache mechanism in vhost, which fails to clear properly when certain commands are executed, leading to translation errors and unbounded memory access. While no public exploitation has been reported, the flaw affects multiple Linux distributions, including Ubuntu, RHEL, Amazon Linux, Microsoft Azure Linux, and Oracle Linux.
The fix, submitted as commit de845981da67, clears the cache whenever the ring is reconfigured. Users are advised to install the patched kernel and restrict access to the vhost device nodes until the issue is resolved.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
