Hi all,
We are disclosing Vghost (CVE-2026-74580), a stale IOTLB metadata-cache
vulnerability affecting Linux vhost frontends.
Impact
------
- Local user with access to /dev/vhost-* -> arbitrary kernel read/write -> root.
- Guest using vIOMMU + iommu_platform + VIRTIO_F_RING_RESET -> QEMU heap
overwrite, and control-flow hijacking.
Bug
---
vq->meta_iotlb[] caches the IOTLB mappings for the descriptor, available,
and used rings. VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM replace the
vring configuration without clearing that cache. A later cache hit skips
range validation and translates the new address through the old mapping:
translated = old_map->addr + new_addr - old_map->start
The translated pointer reaches unchecked raw_copy_to_user() or
raw_copy_from_user(). The defect comes from the interaction of f88949138058
(metadata cache) and 0210a8db2aec (deferred GIOVA validation).
Exploit chain outline
---------------------
The completed local chain:
ATTACKER (uid=1000) VHOST / KERNEL
| |
| configure device IOTLB + vrings |
|------------------------------------>|
| kick queue: prime meta_iotlb[] |
|------------------------------------>|
| |
| VHOST_SET_VRING_ADDR |
| (new address, stale cache kept) |
|------------------------------------>|
| |
| repoint desc ring + kick |
|------------------------------------>| read target as desc[0]
|<------------------------------------| IOTLB_MISS leaks 8 bytes
| |
| read IDT[0] |
|------------------------------------>| recover KASLR slide
| |
| repoint used ring + kick |
|------------------------------------>| write vring_used_elem
| | to runtime modprobe_path
| |
| trigger request_module() |
|------------------------------------>| execute memfd payload
|<------------------------------------| uid=0(root)
| |
| restore modprobe_path |
|------------------------------------>|
The guest-triggered path:
UNTRUSTED GUEST QEMU / VHOST
| |
| prime used-ring metadata cache |
|------------------------------------>|
| queue_reset + new queue address |
|------------------------------------>| VHOST_SET_VRING_ADDR
| queue_enable + kick | (stale cache survives)
|------------------------------------>|
| | used-ring write escapes
| | guest RAM into QEMU heap
| v
| crash / QOM table corruption
| |
| controlled QEMU RIP
CVSS assessment
---------------
CVSS v3.1 Base Score: 8.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix
---
The upstream fix resets the vring metadata cache from
vhost_vring_set_num_addr(), forcing reconfigured addresses through IOTLB
validation again:
https://git.kernel.org/linus/de845981da67a6b049080c87e605130b0c30adc5
The first fixed upstream stable releases identified for the affected series
are:
5.10.265
5.15.216
6.1.183
6.6.152
6.12.104
6.18.45
7.1.9
7.2
Vendor kernels may contain a backport while retaining an older base version.
Tested distributions
--------------------
We reproduced the complete local-user-to-root chain with the same generic
x86-64 exploit on:
- Ubuntu 26.04 LTS, 7.0.0-28-generic
- RHEL 9.8, 5.14.0-687.5.3.el9_8.x86_64
- Amazon Linux 2023.12.20260817, 6.1.180-225.360.amzn2023.x86_64
- Microsoft Azure Linux 3.0, 6.6.150.1-1.azl3
- Oracle Linux 10.2, 6.12.0-204.92.4.2.el10uek
The tested Ubuntu image exposed /dev/vhost-vsock as 0660 root:kvm. The tested
RHEL 9.8, Amazon Linux, Azure Linux, and Oracle Linux images exposed it as 0666,
making the local chain reachable by an ordinary user. In every retained test,
modprobe_path was restored and the temporary root helper was removed.
Mitigation
----------
Apply a kernel containing the upstream fix or the corresponding vendor
backport, and reboot into that kernel.
Until then, restrict access to all vhost device nodes, including
/dev/vhost-net, /dev/vhost-vsock, /dev/vhost-scsi, and /dev/vhost-vdpa-*;
prevent untrusted containers from receiving them; and treat membership in a
device-owning group such as kvm as privileged. Permission changes do not
revoke already-open file descriptors and do not address the guest-triggered
path. For unpatched virtualization hosts, avoid exposing vhost devices with
iommu_platform behind a vIOMMU to untrusted guests.
References
----------
Technical write-up:
https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580
PoC:
https://github.com/zhangutah/security-research/tree/main/pocs/linux/cve-2026-74580
Linux kernel CVE announcement:
https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/
Mainline fix:
https://git.kernel.org/linus/de845981da67a6b049080c87e605130b0c30adc5
Amazon Linux advisory:
https://explore.alas.aws.amazon.com/CVE-2026-74580.html
Oracle Linux errata:
https://linux.oracle.com/errata/ELSA-2026-500248.html
Corvus AI assisted with source analysis, reproduction, exploit development,
and cross-platform validation.
Regards,
Fourie Zhang
TencentOS Security Team (Tencent Zhuque Lab)
