---
title: Vghost (CVE-2026-74580): AI-found Linux vhost bug gives local root, and a guest-to-host QEMU write in vIOMMU setups | ctxsec
url: https://ctxsec.com/items/vghost-cve-2026-74580
description: ""
status: "confirmed (kernel CVE + researcher writeup)"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/vghost-cve-2026-74580.md)

confirmed (kernel CVE + researcher writeup)

2026-10-14

### Vghost (CVE-2026-74580): AI-found Linux vhost bug gives local root, and a guest-to-host QEMU write in vIOMMU setups

Tencent Zhuque Lab / TencentOS Security disclosed a stale-IOTLB-cache bug in Linux `drivers/vhost/vhost.c` on oss-security (Oct 14), with a writeup dated Oct 12. `VHOST_SET_VRING_ADDR`/`VHOST_SET_VRING_NUM` did not reset the vring metadata cache, so a later cache hit skips validation and yields unchecked kernel read/write. With access to `/dev/vhost-net` or `/dev/vhost-vsock`, a local user gets a deterministic path to root. When virtio devices sit behind a vIOMMU with `iommu_platform=on`, an untrusted guest can write out of bounds into the host QEMU process. Affected: 4.11 up to 7.2-rc4. First fixed stable kernels: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2 (fix `de845981da67`). Severity is High (8.8 kernel.org CNA vs 7.3 Red Hat, per The Hacker News). There is no public sign of exploitation. Tencent says its Corvus AI multi-agent pipeline found it, so this is AI-assisted research, not an AI attack. **Until patched:** drop world access to vhost nodes, treat the `kvm` group as privileged, and don't pass vhost devices into untrusted containers. Note that permission changes don't revoke already-open file descriptors, and there's no workaround for the guest path.

Sources: [oss-security disclosure](https://www.openwall.com/lists/oss-security/2026/10/14/2) · [Tencent Zhuque Lab writeup](https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580) · [linux-cve-announce](https://lists.openwall.net/linux-cve-announce/2026/08/21/4) · [The Hacker News](https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html)