AI-Discovered 'Vghost' Linux Kernel Flaw Grants Root Access, Enables VM Escapes
A critical Linux kernel vulnerability, CVE-2026-74580 (Vghost), discovered with AI assistance, allows local users to gain root privileges and enables guest VMs to compromise host memory.
A significant vulnerability dubbed "Vghost" has been identified in the Linux kernel's vhost subsystem, enabling local users to escalate privileges to root and, in certain virtualization configurations, allowing a compromised virtual machine to escape its confines and access the host's memory.
The flaw, formally tracked as CVE-2026-74580, was discovered by Tencent Zhuque Lab, which utilized its AI-powered Corvus AI system for vulnerability research. The lab disclosed the vulnerability on August 3rd and subsequently published a detailed technical write-up along with working exploit demonstrations on October 12th. As of the disclosure, there were no public reports of the vulnerability being actively exploited in the wild.
The vhost subsystem is a critical component of the Linux kernel responsible for accelerating network and other input/output operations for virtual machines and containers. Attackers can typically access vhost by interacting with device nodes such as /dev/vhost-net or /dev/vhost-vsock. The Vghost vulnerability provides an unprivileged local user with a reliable method to read and write arbitrary kernel memory, bypass Kernel Address Space Layout Randomization (KASLR), and ultimately achieve full root privileges on the host system.
A more concerning attack vector, however, targets virtualization environments. When a virtual machine's virtio device is configured with a virtual IOMMU and iommu_platform enabled, and vhost operates in device-IOTLB mode, an untrusted guest VM can exploit this vulnerability. This allows the guest to trigger an out-of-bounds write in the host kernel's memory, specifically targeting the QEMU process responsible for managing the virtual machine. From this compromised state, an attacker could overwrite function pointers within QEMU, enabling them to hijack the host process's execution flow or cause a denial-of-service crash.
The vulnerability stems from a flaw in how vhost caches memory mappings for virtual rings and shared queues. While the cache is intended to speed up operations, it was not invalidated under specific configuration changes (VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM) that altered ring addresses or sizes while the queue was active. This allowed vhost to continue using stale mapping information, leading to subsequent memory accesses without proper bounds checking, thus enabling the kernel read/write primitive.
This vulnerability has existed for approximately nine years, a result of two specific code changes. A 2017 modification introduced the caching mechanism, while a 2020 update moved the address checking to a later stage, inadvertently removing a crucial safeguard that would have caught the stale translations. The affected kernel versions range from 4.11 up to the pre-release 7.2-rc4.
Tencent successfully reproduced the full local-to-root exploit chain on several popular Linux distributions, including Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. The accessibility of the vhost device node varied; on Ubuntu, it was restricted to the kvm group, while on the other tested systems, it was world-readable (mode 0666), making it accessible to any local user.
Patches for Vghost have been released and are available in stable kernel branches, with vendors like Red Hat, Amazon Linux, and Oracle Linux already shipping fixes. Users are urged to update their kernels to a patched version and reboot. Until a patch can be applied, administrators should restrict access to the vhost device nodes, removing world-readable permissions and limiting group membership to trusted virtualization services. For the guest-to-host escape scenario, a patched kernel is the sole remedy.
The vulnerability is rated as high, with differing scores from various organizations, reflecting the nuanced impact. Kernel.org assigned it an 8.8, noting the scope change due to the guest-to-host interaction. Red Hat, however, scored it 7.3, considering the impact to remain within the host's trust boundary. The discovery by an AI system highlights the growing role of artificial intelligence in uncovering complex security flaws, following a similar AI-assisted discovery of an SCTP kernel flaw earlier in the year.