Linux vhost flaw crosses from local root to guest escape
Tencent Zhuque Lab disclosed Vghost, a Linux vhost bug tracked as CVE-2026-74580, on October 12 after fixing it on August 3. The flaw affects the kernel's vhost subsystem, including /dev/vhost-net and /dev/vhost-vsock, and gives a local user a reliable path to kernel read/write and root; in some virtual machine setups, it can also let a guest reach the host side.
The bug is in how vhost reuses a cached memory-mapping check. It approves a ring once, then keeps trusting that old approval after the ring is reconfigured, so later reads and writes can land in the wrong place with no fresh safety check. That makes the attack deterministic and lets it bypass KASLR, the kernel's address-randomization defense.
For operators, the important map is not just the host login surface: any system exposing vhost devices to untrusted local users or guest VMs inherits a trust-boundary problem, and some deployments can turn a kernel bug into host-process compromise. The public write-up with working demos also means this is now a practical exploitation pattern, not a theoretical one.