A security vulnerability in the Linux kernel’s vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to gain root access across nearly a decade of kernel versions. In certain virtualization setups, untrusted virtual machines can exploit the flaw to write to the host’s memory and take control of the program running the virtual machine. Tencent Zhuque Lab discovered the flaw and released a fix on August 3, publishing detailed documentation and working demonstrations on October 12. No public evidence of exploitation has emerged.
The vhost subsystem manages network and input/output acceleration for virtual machines and containers. The vulnerability stems from a cache mechanism that fails to clear when ring configurations change, allowing attackers to access kernel memory without bounds checking. The flaw affects Linux kernels from version 4.11 through 7.2-rc4 and has been confirmed on major distributions. Users should install patched kernels or restrict access to vhost device nodes as a temporary measure. Major Linux distributors including Red Hat, Amazon, and Oracle have released fixes.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
