{
  "id": 14415753,
  "title": "AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host",
  "url": "https://urgent.news/2026/10/14/ai-found-linux-kernel-flaw-gives-local-users-root-and-can-break-a",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-14T07:46:57.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html"
  },
  "original_language": "en",
  "account": "A critical flaw in Linux's vhost subsystem allows local users to gain root privileges across numerous kernel versions, starting from 4.11 up to 7.2-rc4. Tencent Zhuque Lab discovered the vulnerability, which they've named Vghost, and released a patch on August 3, with a comprehensive write-up published on October 12. The flaw, tracked as CVE-2026-74580, grants unprivileged users unrestricted access to kernel memory, permitting both reading and writing operations. This enables attackers to bypass kernel address space layout randomization (KASLR) and escalate privileges to root. The second attack vector involves exploiting virtual machines with virtio devices behind virtual IOMMU, allowing untrusted guests to write out of bounds in the host kernel, potentially hijacking the QEMU process or crashing it. The vulnerability stems from a cache mechanism in vhost, which fails to clear properly when certain commands are executed, leading to translation errors and unbounded memory access. While no public exploitation has been reported, the flaw affects multiple Linux distributions, including Ubuntu, RHEL, Amazon Linux, Microsoft Azure Linux, and Oracle Linux. The fix, submitted as commit de845981da67, clears the cache whenever the ring is reconfigured. Users are advised to install the patched kernel and restrict access to the vhost device nodes until the issue is resolved.",
  "summary": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}