A recent discovery in the Linux vhost subsystem has revealed a significant vulnerability that allows local users to gain root access by reading and writing kernel memory. This flaw, affecting multiple kernel versions over the past decade, poses a serious security risk, particularly in virtualization environments. Known as CVE-2026-74580, or Vghost, this issue was identified by Tencent Zhuque Lab, which released a corrective patch on August 3 and an extensive summary on October 12, complete with demonstration attacks. Fortunately, there are no reports of this flaw being exploited in the wild.
Understanding the Vulnerability
The vhost component of the Linux kernel is essential for enhancing the performance of network and other I/O operations in virtual machines and containers. A local user can exploit this flaw by accessing a device node, typically /dev/vhost-net or /dev/vhost-vsock. This vulnerability provides an unprivileged user with the capability to read and write any kernel address, circumvent KASLR, and escalate their privileges to root. The attack is precise and does not require complex memory manipulation.
Another facet of the attack is its potential impact on virtual machines. When the virtio device of a virtual machine is set behind a virtual IOMMU with the iommu_platform enabled, and vhost operates in device-IOTLB mode, an untrusted guest can provoke the same vulnerability. This can lead to the host kernel writing outside of its intended bounds into the host’s QEMU process, allowing the guest to manipulate function pointers and potentially control or crash the host process.
Technical Insights into the Flaw
The vhost subsystem manages a small cache for memory mappings related to virtual rings and shared queues. Typically, this cache is cleared when mappings are updated or queues reset, but not when commands like VHOST_SET_VRING_ADDR change the ring’s addresses or size while active. With a device IOTLB present, these commands accept new addresses without immediate verification, leading to unchecked use of outdated memory mappings. Consequently, data is copied to or from these pointers without proper bounds checking, enabling unauthorized kernel memory access.
This flaw remained undetected for nearly nine years due to gradual changes in the kernel. A 2017 update introduced the cache mechanism, while a 2020 modification deferred address validation, allowing the issue to persist unnoticed.
Impact and Mitigation
The affected Linux kernel versions range from 4.11 to 7.2-rc4. Tencent successfully demonstrated the local user-to-root escalation on five distributions: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. In some distributions, device nodes were limited to specific user groups, while others were universally accessible.
The corrective patch, identified as commit de845981da67, effectively clears the cache whenever the ring is reconfigured. Updated kernel versions have been released for various branches, and major distributions like Red Hat, Amazon Linux, and Oracle Linux have already incorporated these fixes. Users are advised to install the updated kernels and reboot their systems promptly.
While a patched kernel resolves the issue, interim measures include restricting access to vhost device nodes and treating group membership as a privilege. However, there is no temporary workaround for the guest-to-host escape scenario, emphasizing the urgency of applying the patch.
Severity and Discovery
This vulnerability is rated high severity, with differing opinions on its exact impact. The CVE team at kernel.org assigns it a score of 8.8, noting its potential to breach host memory boundaries. Meanwhile, Red Hat assesses it at 7.3, viewing the impact as contained within the host, while Amazon and Oracle assign scores of 7.8 and 7.3, respectively.
The vulnerability was identified with the assistance of Corvus AI, a sophisticated multi-agent system developed by Tencent for kernel vulnerability research. The AI played a supportive role in discovering this flaw, similar to its involvement in uncovering a significant SCTP kernel issue earlier this year.
This discovery underscores the ongoing need for vigilance in security practices and the importance of timely updates to safeguard systems against emerging threats.
