CVE-2026-74580 - Linux vhost root bug
Posted: Tue Oct 13, 2026 1:17 pm
Corvus AI discovered a high-severity memory corruption vulnerability in Linux's vhost virtualization acceleration subsystem (CVE-2026-74580, CVSS 8.8). The defect spans nearly a decade of kernel releases from Linux 4.11 through 7.2, impacting distributions including Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux.
The vulnerability provides dual exploitation vectors: host local privilege escalation and virtual machine escape. On the host, it yields deterministic, race-free arbitrary kernel read and write primitives without heap grooming or kernel structure layout dependencies, enabling unprivileged users to bypass KASLR and escalate to root. In virtualized environments with a virtual IOMMU, an untrusted guest can trigger the same stale-cache condition via VIRTIO_F_RING_RESET, inducing the host kernel to write out-of-bounds into the host QEMU process heap.
The kernel.org CNA rates it 8.8 High
More Information:
https://www.cve.org/CVERecord?id=CVE-2026-74580
The vulnerability provides dual exploitation vectors: host local privilege escalation and virtual machine escape. On the host, it yields deterministic, race-free arbitrary kernel read and write primitives without heap grooming or kernel structure layout dependencies, enabling unprivileged users to bypass KASLR and escalate to root. In virtualized environments with a virtual IOMMU, an untrusted guest can trigger the same stale-cache condition via VIRTIO_F_RING_RESET, inducing the host kernel to write out-of-bounds into the host QEMU process heap.
The kernel.org CNA rates it 8.8 High
More Information:
https://www.cve.org/CVERecord?id=CVE-2026-74580