Vulnerabilities · 9h ago

Linux vhost flaw crosses from local root to guest escape

Tencent Zhuque Lab disclosed Vghost, a Linux vhost bug tracked as CVE-2026-74580, on October 12 after fixing it on August 3. The flaw affects the kernel's vhost subsystem, including /dev/vhost-net and /dev/vhost-vsock, and gives a local user a reliable path to kernel read/write and root; in some virtual machine setups, it can also let a guest reach the host side.

The bug is in how vhost reuses a cached memory-mapping check. It approves a ring once, then keeps trusting that old approval after the ring is reconfigured, so later reads and writes can land in the wrong place with no fresh safety check. That makes the attack deterministic and lets it bypass KASLR, the kernel's address-randomization defense.

For operators, the important map is not just the host login surface: any system exposing vhost devices to untrusted local users or guest VMs inherits a trust-boundary problem, and some deployments can turn a kernel bug into host-process compromise. The public write-up with working demos also means this is now a practical exploitation pattern, not a theoretical one.

CVE-2026-74580

NVD KEV

EPSS 0.1% (2nd percentile).

Timeline

Oct 14 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Oct 14
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
Linux's Vghost flaw lets users with vhost device access gain root and, in specific VM setups, lets guests hijack host QEMU.

Entities

CVE-2026-74580

Part of the PlainSec briefing for 2026-10-14

Editions

Briefing for 2026-10-14

Vulnerabilities · 9h agoLinux vhost flaw crosses from local root to guest escapeTencent Zhuque Lab disclosed Vghost, a Linux vhost bug tracked as CVE-2026-74580, on October 12 after fixing it on August 3. The flaw affects the kernel's vhost subsystem, including /dev/vhost-net and /dev/vhost-vsock, and gives a local user a reliable path to kernel read/write and root; in some virtual machine setups, it can also let a guest reach the host side.The bug is in how vhost reuses a cached memory-mapping check. It approves a ring once, then keeps trusting that old approval after the ring is reconfigured, so later reads and writes can land in the wrong place with no fresh safety check. That makes the attack deterministic and lets it bypass KASLR, the kernel's address-randomization defense.For operators, the important map is not just the host login surface: any system exposing vhost devices to untrusted local users or guest VMs inherits a trust-boundary problem, and some deployments can turn a kernel bug into host-process compromise. The public write-up with working demos also means this is now a practical exploitation pattern, not a theoretical one.