A significant security vulnerability affecting Linux systems has been identified, involving a flaw in the vhost mechanism. Tracked as CVE-2026-74580, this bug allows a local attacker to gain root privileges or, in specific virtual machine configurations, to escape from a guest environment and impact the host system. With a CVSS v3.1 score of 8.8, this high-severity issue has been addressed in the latest Linux kernel updates.
Understanding the Vhost Flaw
The vhost subsystem in the Linux kernel facilitates efficient data transfer between virtual machines and their host by utilizing shared virtual queues, known as virtqueues. The vulnerability arises from the way vhost manages IOTLB mappings, which are used to locate these queues in memory.
The issue manifests during the reconfiguration of a virtual ring, where the system updates the ring’s address or size but fails to clear the cached mapping for the ring’s data. Consequently, subsequent operations might bypass address validation checks, leading to potential pointer misuse in kernel copy routines.
Exploitation and Impact
For local privilege escalation, an attacker must first gain access to a vhost device, such as /dev/vhost-net. By manipulating the cache and altering a ring address without updating the cache entry, attackers can execute kernel memory reads and writes. This method exploits address randomization offsets and modifies the kernel’s modprobe_path to execute a malicious helper with root privileges.
Testing showed successful exploitation on various Linux distributions, including Ubuntu 26.04 and RHEL 9.8. Notably, device permission settings vary, with some systems restricting access to specific groups like kvm, while others allow broader user access. This discrepancy highlights the importance of device permission management but underscores the necessity of patching to mitigate risks.
Preventive Measures and Fixes
The vulnerability also poses a risk of VM escape in configurations utilizing a vhost device with a virtual IOMMU and the virtio queue-reset feature. This allows for a guest-initiated queue reset that can lead to metadata cache corruption, potentially crashing or altering the QEMU process.
An upstream fix has been implemented to clear the vring metadata cache upon ring address or size changes, ensuring new configurations undergo IOTLB validation. Administrators are strongly advised to update to kernel versions 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2, or to apply vendor backports, followed by a system reboot.
Until systems are patched, it is crucial to limit access to all vhost device nodes and avoid exposing these devices to untrusted containers. Additionally, unpatched virtualization hosts should refrain from presenting vhost devices with iommu_platform to untrusted guests, as permission changes do not revoke pre-existing file descriptors.
For further insights, refer to resources from Tencent Zhuque Lab and GitHub. Stay informed about Linux kernel privilege escalation and virtualization security by following Cyber Security News.
