Vghost (CVE-2026-74580): How a Linux Kernel vhost Cache Bug Gives Local Root and Can Escape a VM

A bug that lived in the Linux kernel's vhost subsystem for years can hand an unprivileged local user root, and in some configurations let an untrusted guest escape its virtual machine. Here is how it works, which versions fix it, and why it matters to anyone running AI workloads on shared KVM hosts.

What Vghost Is and What It Affects

Vghost is a vulnerability in the Linux kernel's vhost subsystem, which accelerates network and virtual-socket I/O for virtual machines. The CVE-2026-74580 record (published August 21, 2026) rates it CVSS 8.8 (high) and covers kernel 4.11 up to the versions before the fixed ones. The Hacker News published the full analysis on October 12 and attributes it to Tencent Zhuque Lab, assisted by Corvus AI, a multi-agent system for kernel vulnerability research; Tencent Cloud's announcement (September 20) refers to Tencent's security team. The AI's role comes from that coverage and does not appear in the CVE record.

How It Works: A Cache That Survives Reconfiguration

Vhost keeps a cache of memory translations for the virtual rings (vrings). When a program reconfigures the ring with the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM calls, the cache was not reset: it kept translating using stale mappings. According to The Hacker News, the flaw arises from two separate changes: the introduction of the cache in Linux 4.11 (2017) and the relocation of a check in Linux 5.9 (2020). With the device IOTLB active, certain address commands skipped validation, and copies to and from user space accessed memory outside the region actually mapped.

Two Attack Paths

Local escalation. An unprivileged user with access to /dev/vhost-net or /dev/vhost-vsock gets read and write access to kernel memory, bypasses KASLR, and reaches root. VM escape. With virtio behind a virtual IOMMU (iommu_platform in device-IOTLB mode), an untrusted guest can overwrite a function pointer in QEMU and control where the host process executes. Tencent Cloud states that its CVM instances were verified as not vulnerable to the escape.

Fixed Versions and Mitigation

What This Means for a Company Using or Buying AI