CVE-2026-74580 with a CVSS score of 8.8 is a high-severity Linux kernel vulnerability in the vhost subsystem that affects Linux kernels from 4.11 up to 7.2-rc4. The flaw occurs because vhost caches memory mappings for virtual rings and shared queues, and a cache hit is treated as proof that a region was already checked. When VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM changes a live queue's addresses or size, the cache is not cleared, so later translation uses stale mappings and copies data without a bounds check. A local user can exploit it by opening a device node such as /dev/vhost-net or /dev/vhost-vsock, then reading or writing arbitrary kernel memory, bypassing KASLR, and escalating to root in a deterministic way that requires no memory grooming or lucky timing. In a virtualization setup where a virtio device is behind a virtual IOMMU with iommu_platform enabled and vhost runs in device-IOTLB mode, an untrusted guest can trigger the same bug, causing the host kernel to write out of bounds into the host's QEMU process, overwrite a function pointer, and either redirect execution or crash the process. The business impact includes local privilege escalation, guest-to-host escape, loss of confidentiality and integrity, and disruption of virtualized workloads.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-74580 with a CVSS score of 8.8 is a high-severity Linux kernel vulnerability in the vhost subsystem that affects Linux kernels from 4.11 up to 7.2-rc4. The flaw occurs because vhost caches memory mappings for virtual rings and shared queues, and a cache hit is treated as proof that a region was already checked. When VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM changes a live queue's addresses or size, the cache is not cleared, so later translation uses stale mappings and copies data without a bounds check. A local user can exploit it by opening a device node such as /dev/vhost-net or /dev/vhost-vsock, then reading or writing arbitrary kernel memory, bypassing KASLR, and escalating to root in a deterministic way that requires no memory grooming or lucky timing. In a virtualization setup where a virtio device is behind a virtual IOMMU with iommu_platform enabled and vhost runs in device-IOTLB mode, an untrusted guest can trigger the same bug, causing the host kernel to write out of bounds into the host's QEMU process, overwrite a function pointer, and either redirect execution or crash the process. The business impact includes local privilege escalation, guest-to-host escape, loss of confidentiality and integrity, and disruption of virtualized workloads.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]