AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A critical flaw identified in Linux's vhost subsystem, known as CVE-2026-74580 or Vghost, has been discovered, allowing local users to read and write kernel memory, potentially escalating privileges to root across nearly a decade of kernel versions. This vulnerability also enables an untrusted virtual machine to write to the host's memory and take control of the program running the virtual machine. The flaw was discovered by Tencent Zhuque Lab, which released a fix on August 3, followed by a detailed write-up and demonstration of the exploit on October 12. As of now, there is no public evidence of the flaw being exploited. The vhost subsystem in Linux is designed to enhance the speed of network and other input/output operations for virtual machines and containers. Users can access it through device nodes like /dev/vhost-net or /dev/vhost-vsock. The flaw allows an unprivileged user on the host to reliably read and write any kernel address, bypass Kernel Address Space Layout Randomization (KASLR), and escalate privileges to root. This attack is deterministic, requiring no memory grooming or precise timing to succeed. A secondary, more specific attack occurs when a virtual machine's virtio device is behind a virtual IOMMU with iommu_platform enabled, and vhost operates in device-IOTLB mode. In this scenario, an untrusted guest can exploit the same bug, causing the host kernel to write out of bounds into the host's QEMU process. This allows the guest to overwrite a function pointer in QEMU, potentially taking control of the host process or causing it to crash. The vulnerability persisted in the code for approximately nine years due to two incremental changes. In 2017, Linux 4.11 introduced a cache and its shortcut, while a 2020 update in Linux 5.9 moved address checking to a later step, inadvertently removing the check that would have caught the stale translation. This oversight allowed the flaw to remain undetected for years. The flaw affects Linux kernels from version 4.11 up to 7.2-rc4. Tencent successfully reproduced the exploit chain on several distribution kernels, including Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On Ubuntu, access to the device node was restricted to the kvm group, while on other distributions, it was world-readable, making it accessible to any local user. To address the issue, a fix (commit de845981da67) was implemented, which clears the cache whenever the ring is reconfigured. Users are advised to install a kernel containing this fix and reboot their systems. The first fixed upstream stable releases are available for various branches, and vendors may backport the fix without altering their version numbers. Red Hat, Amazon Linux, and Oracle Linux have already shipped fixes, while Ubuntu is still working on updates for some of its kernels. Until a patched kernel is available, it is recommended to restrict access to the vhost device nodes by removing world access and limiting the owning group to trusted virtualization services. Membership in this group should be treated as a privilege while running a vulnerable kernel. There is no interim workaround for the guest-to-host escape, making the patched kernel the only solution. The severity of the flaw is rated high, though not critical, with varying scores from different organizations. The kernel.org CVE team rates it 8.8, while Red Hat scores it at 7.3, and Amazon and Oracle rate it at 7.8 and 7.3, respectively. The flaw was discovered with the help of Corvus AI, a multi-agent system developed by Tencent for kernel vulnerability research, marking another instance of machine-assisted research in identifying critical vulnerabilities.