Tencent's Zhuque Lab has disclosed a Linux kernel vulnerability in the vhost subsystem, tracked as CVE-2026-74580 and named Vghost. The bug allows an unprivileged local user to read and write arbitrary kernel memory, bypass KASLR, and escalate to root. In a second attack scenario, an untrusted virtual machine can trigger the same flaw to write out of bounds into the host's QEMU process, potentially hijacking it or crashing it. No public exploitation has been observed yet.
The root cause lies in a stale cache of memory mappings used by vhost. A 2017 change added a cache that treats a hit as proof of prior validation, and a 2020 change moved address checking to a later step, leaving the cache unchecked when ring addresses or sizes are changed via certain commands. This lets the kernel copy data to or from a pointer outside the intended region, yielding kernel read and write. The flaw affects kernels from 4.11 up to 7.2-rc4, with Tencent reproducing the local-to-root chain on five major distribution kernels.
Vendors have begun shipping fixes, with the first patched stable releases listed for branches from 5.10.y to 7.2. Until a patched kernel is installed, administrators should restrict access to /dev/vhost-net and /dev/vhost-vsock, removing world permissions and limiting the owning group to trusted services. There is no interim workaround for the guest-to-host escape. The flaw was discovered with help from Tencent's Corvus AI, a multi-agent system for kernel research, and the fix credits it with an Assisted-by line. Severity ratings vary: kernel.org scores it 8.8 with a changed scope, while Red Hat and Oracle score it 7.3, reflecting differing views on whether the guest-to-host write crosses a trust boundary.