Vghost Linux vhost flaw CVE-2026-74580 enables root and VM escape
TencentOS researchers disclosed "Vghost" (CVE-2026-74580), a Linux kernel vhost bug. A local user with vhost device access can gain root. A guest can attack host QEMU in a narrow vIOMMU setup. CVSS 3.1 8.8 (High, scored by the kernel CNA). Fixed in stable kernels. Public researcher PoC. Not in CISA KEV.
Published 14 Oct 2026
What happened
On 14 October 2026, Fourie Zhang of the TencentOS Security Team (Tencent Zhuque Lab) disclosed "Vghost" on the oss-security list. The team also published a technical write-up. Corvus AI is credited with assisting the research.
Vghost is CVE-2026-74580, a bug in the Linux kernel vhost subsystem. The kernel kept a cached ring mapping after a ring was reconfigured. Later reads and writes could then land outside the mapped memory.
The Linux kernel CNA published the CVE on 21 August 2026, with the upstream fix. The researcher disclosure came almost two months later.
Who is affected
Linux kernels from 4.11 are affected until the fixed releases. Fixed upstream stable versions are 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Distribution kernels may carry the fix under an older version number.
The local path needs a user who can open a vhost device node, such as vhost-net or vhost-vsock. The researchers say some distributions ship vhost-vsock readable and writable by every user. On those systems an ordinary account is enough. On others, membership in a group such as kvm is needed.
The "VM escape" path is narrower. It targets KVM hosts where QEMU uses in-kernel vhost. The guest must sit behind a virtual IOMMU, and its virtio device must have iommu_platform enabled. In that setup, the researchers say a malicious guest can corrupt the host QEMU process. That is a guest-to-host escape into the QEMU process, not a direct host kernel takeover.
What is confirmed
The kernel CNA scores the flaw CVSS 3.1 8.8 (High). NVD lists that score and has no score of its own yet. Red Hat rates it Important, with CVSS 3.1 7.3. SUSE rates it moderate, with 5.5. Ubuntu gives it Medium priority.
Debian has fixed kernels for bookworm and trixie security. Ubuntu has released fixed kernels for several releases. Amazon Linux and Oracle Linux (ELSA-2026-500248) have advisories. Red Hat has fixes for RHEL 7 ELS and RHEL 9.6 EUS. It still lists RHEL 8, 9 and 10 kernels as affected. SUSE lists the issue as pending.
The researchers say they reached root on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2. They published a PoC in a GitHub repository under the account zhangutah. It claims to be a proof of concept for CVE-2026-74580. ThreatWire did not run it.
The CVE is not in the CISA KEV catalog.
What is not confirmed
No source reports exploitation in the wild. The distribution test results come from the researchers and have not been independently reproduced. ThreatWire did not test the VM escape claim.
ThreatWire found no coverage in major security news outlets at the time of writing. Distribution fix status is changing. Check your vendor page before you conclude a kernel is safe.
What to do
Install a kernel that contains the fix or your vendor's backport. Then reboot into it. A kernel update does nothing until the host runs the new kernel.
Until then, restrict access to all vhost device nodes. Do not pass them to untrusted containers. Treat the kvm group as privileged. Permission changes do not close already open handles. They also do not block the guest path.
On unpatched virtualization hosts, do not give untrusted guests vhost devices behind a virtual IOMMU with iommu_platform enabled. Prioritize multi-tenant KVM hosts and shared Linux systems.
Sources: the CVE.org record, the Linux kernel CVE announcement and fix commit, NVD, the researchers' oss-security post and write-up, Tencent Cloud, and advisories from Red Hat, Ubuntu, Debian, SUSE, Amazon Linux and Oracle Linux. Links are in the references list.