CVE-2026-74580

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.11 through 7.2-rc4

Description A stale cache entry in the vhost subsystem allows a local user to achieve privilege escalation to root or enables a guest-to-host escape on virtualized hosts. The issue occurs because the vq->meta iotlb[] cache, which stores IOTLB mappings for descriptor, available, and used rings, is not reset during vring reconfiguration via VHOST SET VRING ADDR or VHOST SET VRING NUM. This allows the system to use stale memory mappings and perform out-of-bounds memory access through vhost copy to user() and vhost copy from user() without proper bounds checks.

Technical details include:

On certain distributions like RHEL, Amazon Linux, Azure Linux, and Oracle Linux, the affected device nodes are exposed with 0666 permissions, making the local privilege escalation reachable by any user.

Recommendations Update to Linux kernel versions 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. As a temporary mitigation, restrict access to the device nodes /dev/vhost-net and /dev/vhost-vsock using chmod to prevent untrusted local users from accessing them. Prevent untrusted containers from accessing any /dev/vhost-* devices. Avoid exposing vhost devices with iommu platform to untrusted guests.