CVE-2026-74580

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vhost component where the vring metadata cache vq->meta iotlb[] is not reset during vring reconfiguration. Specifically, when VHOST SET VRING ADDR replaces vq->desc, vq->avail, and vq->used, or when VHOST SET VRING NUM changes region sizes, the cache remains populated with stale entries. This allows iotlb access ok() to return early on a cache hit, bypassing necessary validation. Consequently, vhost vq meta fetch() may translate addresses using an old mapping that no longer covers the current region. This leads to vhost copy to user() and vhost copy from user() accessing memory outside the region actually mapped by the IOTLB during used ring updates or descriptor fetches.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.