A severe security hole has been uncovered in the Linux kernel’s vhost subsystem that grants unprivileged users full root access on vulnerable systems and, under certain conditions, allows virtual machines to escape confinement and attack the host. The vulnerability was discovered by Tencent’s Zhuque Lab and given the designation CVE-2026-74580 and the nickname “Vghost.”
What’s Vhost & Why It Matters
The vhost subsystem accelerates network and other I/O operations for virtual machines and containers. Local users typically interact with it via device nodes like /dev/vhost-net or /dev/vhost-vsock. The newly found flaw enables an attacker to read or write arbitrary kernel memory and bypass KASLR (Kernel Address Space Layout Randomization), thereby escalating privileges to root. This attack is fully deterministic and does not require timing or memory grooming tricks.
In the virtualization context—with a guest VM, virtio device, a virtual IOMMU enabled (via iommu_platform), and the vhost operating in device-IOTLB mode—the vulnerability can be weaponized to make the host kernel write out of bounds into the host’s QEMU process. From there, a guest could overwrite a function pointer and hijack control flow or crash the host.
Origin & Timeline of the Flaw
The flaw has been present in Linux kernels since version 4.11 (circa 2017), when modifications introduced a cache shortcut for mapping checks. A follow-on change in version 5.9 (2020) shifted address checking to a later stage, eliminating protection against stale translations.
Tencent released a fix on August 3, 2026, and publicly disclosed full details—including proof-of-concept exploits—on October 12. There’s no evidence yet that the bug has been exploited in the wild.
Affected Systems & Patches
Kernels from version 4.11 up through 7.2-rc4 are vulnerable. Tencent tested the exploit path on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On four of those, the vhost device nodes were set to 0666, meaning any local user could access them; Ubuntu had slightly tighter restrictions via group membership.
The patch (commit de845981da67) rectifies the issue by clearing the mapping cache whenever the virtual ring configurations change. Fixed versions include:
- 5.10.y → 5.10.265
- 5.15.y → 5.15.216
- 6.1.y → 6.1.183
- 6.6.y → 6.6.152
- 6.12.y → 6.12.104
- 6.18.y → 6.18.45
- 7.1.y → 7.1.9
- 7.2 → 7.2
Distributions including Red Hat, Amazon Linux, Oracle Linux have issued the fix; Ubuntu patched 22.04, while kernels in 24.04 and 26.04 were still pending as of October 13.
Risk & Immediate Mitigations
The severity has been rated high rather than critical. Upstream assessment scores it at 8.8, while vendors such as Red Hat, Oracle, and Amazon have offered slightly lower ratings based on impact and threat model.
Until patched kernels are deployed, administrators are advised to remove unrestricted access to vhost device nodes: restrict or change permissions on /dev/vhost-net and /dev/vhost-vsock, limit their ownership to trusted service groups, and treat membership in those groups as privileged. For the guest-to-host escape vector—via virtualization setups with IOMMU and vhost in device-IOTLB mode—there is no workaround except to apply the patch.
Interestingly, the vulnerability was discovered with assistance from Corvus AI, Tencent’s multi-agent system for kernel security research. It’s credited with “Assisted-by” in the upstream fix—but the discovery was part of research, not an attack. This system also found another serious kernel flaw earlier in 2026.
Vghost underscores a growing truth: AI-assisted security tools are increasingly effective in uncovering long-standing, subtle bugs in foundational software. Organizations should audit kernel settings and permissions, plan for accelerated patch cycles, and monitor whether this weakness begins to surface in active exploits. Watch for updates from major Linux distros—delayed patches or world-readable device nodes could drive real risk.
