Index

Search

Search the public record. Drafts and scheduled notes are not included.

research

Vghost Linux vhost flaw CVE-2026-74580 enables root and VM escape

TencentOS researchers disclosed "Vghost" (CVE-2026-74580), a Linux kernel vhost bug. A local user with vhost device access can gain root. A guest can attack host QEMU in a narrow vIOMMU setup. CVSS 3.1 8.8 (High, scored by the kernel CNA). Fixed in stable kernels. Public researcher PoC. Not in CISA KEV.

Published 3h ago

HighPoC Available

CVE-2026-74580

Linux kernel vhost stale IOTLB cache "Vghost" privilege escalation

LPE

Published 21 Aug 2026