-
Vghost puts Linux systems at risk; it can allow a local user to read and change kernel memory and also let them gain root access.
-
Virtual machines face a second risk. With certain settings, a hostile guest can write to the host computer’s QEMU process and disrupt it.
-
To fix this issue, admins would need to perform a kernel update. And limiting access to vhost devices is crucial while preparing the update.
A Linux flaw could put servers and virtual machines at risk. The bug went unnoticed for almost nine years. Tencent Zhuque Lab calls it Vghost and published its findings on October 12, 2026.
The flaw has the ID CVE-2026-74580. It affects a part of Linux called vhost. This code helps virtual machines move network data and other information faster.
Researchers showed two ways to use the bug. First, a person with local access can gain root rights. Second, a person inside a virtual machine may attack the host computer under certain settings.
Tencent also shared working demos of both attacks. So far, researchers have not reported confirmed attacks in the wild. That, however, doesn’t mean it’s safe to ignore the flaw. Instead, it’s important that admins check their systems and apply the fix.
How the Vghost flaw works
Linux uses vhost to help virtual machines share data with the host. To speed up that work, vhost saves details about memory areas used by virtual devices.
The problem starts when those memory details change. The kernel should clear the old cache when a device changes a ring’s address or size. Otherwise, Linux may keep using an old map.
Vghost lets some commands change a ring’s address or size without clearing that cache. When a device uses a virtual I/O memory table, Linux also puts off checking the new address.
As a result, the kernel may trust old details instead of checking the new memory area. It can then read or write beyond the area it should use.
That error gives an attacker a way to reach memory that should stay off-limits. On a vulnerable host, a local user can use this access to gain root rights.
Root is the highest level of control on Linux. With root access, an attacker can get past normal limits and may take control of the system. That is why a bug that starts with local access can still pose a serious risk.
Another Linux security issue, DirtyDecrypt, also highlights the risks of local privilege escalation, as detailed in the DirtyDecrypt Linux security bug, which allows local root privilege escalation.
Virtual machines face a second threat
Vghost may also let an attacker move from a guest virtual machine into its host. This matters because cloud firms and businesses use virtual machines to keep apps and customers apart.
Still, this attack needs a certain setup. The virtual machine must use the vhost code and a virtual IOMMU. Its virtio device must also turn on the iommu_platform setting. The device IOTLB path must be active too.
With these settings, an untrusted guest can trigger the flaw. The host kernel may then write past the proper memory area and damage the host’s QEMU process.
QEMU is software that runs virtual machines. An attacker can change a function pointer in QEMU’s memory. That pointer basically tells the program what to do next. Change it, and someone could hijack the program’s flow or just crash it entirely.
The demo shows a path across the guest-host boundary. However, that doesn’t mean every system is suddenly up for grabs. Everything depends on how the host is set up and what the attacker tries after.
Even so, cloud operators should take note. If an attacker breaks the wall between a guest and its host, other workloads on the same server may face risk.
How the bug stayed hidden for years
Tencent traced Vghost to two changes in Linux. A change in 2017 added the memory cache. Then, a change in 2020 moved the address check out of the first command and into a later step.
These changes made the vulnerability possible. The cache could keep an old map, while the later check could trust that old entry. The problem came from how the two changes worked together.
Tencent says its Corvus AI system helped find the bug. Corvus AI uses several AI agents to study kernel code for security flaws. The lab says the system found Vghost in about two hours. It also helped test the attacks and review the fix.
The fix is in Linux commit de845981da67. It clears the cache when a ring changes. Linux has to check the updated memory map it can’t just rely on old info anymore.
This case is a good example of how AI helps security teams spot flaws buried in complicated code. Just to be clear: AI didn’t actually launch attacks. It helped researchers find and test a bug.
Which Linux systems need a check?
Researchers say the flaw affects Linux kernels from 4.11 all the way to 7.2-rc4. But some vendors might have patched their older versions already. So, the version number alone may not show whether a system is safe.
Tencent tested it on five popular Linux systems, Ubuntu 26.04, Microsoft Azure Linux 3.0, Amazon Linux 2023, and Red Hat Enterprise Linux 9.8 and Oracle Linux 10.2.
Device access also changed the risk. On the tested Ubuntu system, a user needed to belong to the kvm group to reach the device. On the other four systems, the device allowed access to any local user.
Admins should check both the kernel patch level and who can open vhost devices. The first fixed upstream stable releases include:
- Linux 5.10.265
- Linux 5.15.216
- Linux 6.1.183
- Linux 6.6.152
- Linux 6.12.104
- Linux 6.18.45
- Linux 7.1.9
- Linux 7.2
These are upstream versions, not a full list of vendor packages. A Linux vendor may add the fix to an older package. For that reason, admins should check the security page for their own system.
For example, Ubuntu’s security notice listed Ubuntu 22.04 as fixed. As of October 13, it still marked the fix for Ubuntu 24.04 and 26.04 as in progress. Admins can also check the Red Hat notice and the Amazon Linux notice.
What admins should do now?
The solution to this vulnerability is rather simple: install a kernel with the patch and restart your system using it.
In case the above solution has not been implemented yet, limit access to /dev/vhost-net, /dev/vhost-vsock, and other vhost devices as applicable. Take away access from the users who don’t need it. Make the owner group of this device small and make sure that it only consists of trustworthy services.
Also, stop untrusted containers from opening these devices. Note that changing permissions of a device will not help you to deny access to a process that has already accessed the device.
For the guest-to-host attack, access rules alone will not fix the flaw. Tencent says there is no interim fix for that attack path. A patched kernel remains the key step.
Vendors do not all give the flaw the same severity score. The kernel.org CVE team gives it a score of 8.8 and marks the scope as changed. Red Hat gives it 7.3 and marks the scope as unchanged. Amazon gives it a 7.8 rating while Oracle rates it 7.3.
The differences in the rating scores show the varying opinions about the scope and effect of the attack. However, the essence of the risk is that the Vghost vulnerability allows a local user to get root privileges, and some VM configurations could leave the host open for guests.
The problem is a good illustration of how a little error in handling memory can cause huge consequences. Admins need to act quickly, check their systems, review vendor notices, limit device access, and also install the right patch.
