Linux kernel flaw Vghost, credited to a Tencent AI, allows root access

On October 12, Tencent's Zhuque Lab published its analysis of Vghost, a Linux kernel vulnerability tracked as CVE-2026-74580. It affects vhost, the module that speeds up communication between virtual machines and their host (networking, vsock). The kernel's CVE authority (kernel.org) gives it a score of 8.8 out of 10. It lets a local user with access to vhost devices gain root privileges. In one particular configuration, a malicious virtual machine could also attack the host's QEMU process. The patch was merged into the kernel on August 3: you still need to check that your servers have received it.

Two attack scenarios

The flaw stems from an address translation cache that is not flushed when the virtio ring is reconfigured. The ring is the queue used to exchange data between the guest and the host. A stale translation can then be used with no bounds check. According to Tencent, the attacker can thus read and write anywhere in kernel memory. The researchers demonstrated privilege escalation on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2. The demonstrations go through /dev/vhost-vsock, but the flaw also affects /dev/vhost-net. Several distributions leave these files open to everyone (0666 permissions), whereas Ubuntu restricts them to root and the kvm group.

The second scenario, a virtual machine escape, requires a specific configuration: a virtual IOMMU, the iommu_platform option and the “device IOTLB” mode. In that case, according to Tencent, a guest can write out of bounds in the memory of the host's QEMU process, to the point of hijacking its execution or crashing it.

A discovery credited to AI

Tencent says that Corvus, its AI system, found the flaw in about two hours. Its Hunyuan Hy4-preview model was then reportedly used to verify the exploit and the patch. These claims come from the company itself and have not been independently assessed. The faulty code dates back to Linux 4.11, in 2017. Red Hat describes the flaw as an out-of-bounds memory access that could lead to information disclosure, data corruption or denial of service. So far, we have found no reports of exploitation in real-world attacks.

What to do

• Install a patched kernel: stable versions 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2, or the patch backported by your distribution. Amazon Linux and Oracle Linux have published advisories. Then reboot: a kernel that is installed but not loaded does not protect you.
• In the meantime, remove general access to the /dev/vhost-* files and restrict it to trusted virtualization groups.
• Do not give these devices to untrusted containers, and treat membership in the kvm group as a privilege.
• If a machine does not need accelerated virtio virtualization, Red Hat suggests preventing the module from loading: echo "install vhost /bin/true" > /etc/modprobe.d/disable-vhost.conf. Caution: VM performance may drop, and some VMs may no longer start.