Tencent Zhuque Lab / TencentOS Security disclosed a stale-IOTLB-cache bug in Linux drivers/vhost/vhost.c on oss-security (Oct 14), with a writeup dated Oct 12. VHOST_SET_VRING_ADDR/VHOST_SET_VRING_NUM did not reset the vring metadata cache, so a later cache hit skips validation and yields unchecked kernel read/write. With access to /dev/vhost-net or /dev/vhost-vsock, a local user gets a deterministic path to root. When virtio devices sit behind a vIOMMU with iommu_platform=on, an untrusted guest can write out of bounds into the host QEMU process. Affected: 4.11 up to 7.2-rc4. First fixed stable kernels: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2 (fix de845981da67). Severity is High (8.8 kernel.org CNA vs 7.3 Red Hat, per The Hacker News). There is no public sign of exploitation. Tencent says its Corvus AI multi-agent pipeline found it, so this is AI-assisted research, not an AI attack. Until patched: drop world access to vhost nodes, treat the kvm group as privileged, and don't pass vhost devices into untrusted containers. Note that permission changes don't revoke already-open file descriptors, and there's no workaround for the guest path.