AI Discovers Decade-Old Linux Vhost Vulnerability Enabling Host Escapes and Privilege Escalation
Flaw in kernel vhost subsystem exposes major cloud distributions to root escalation.
1Decade-Old Flaw Uncovered
Tencent Zhuque Lab identified CVE-2026-74580, dubbed Vghost, inside the Linux kernel vhost subsystem. The bug spans nearly ten years of releases from version 4.11 through 7.2-rc4. Researchers produced working exploit demos showing local privilege escalation to root alongside virtual machine escapes into host memory spaces.
2Mechanics Behind Memory Corruption
The vhost subsystem accelerates input and output operations by caching ring memory mappings. When commands like VHOST_SET_VRING_ADDR modify active queues, the cache fails to clear. Consequently, subsequent bound checks are skipped entirely. The kernel translates stale pointers, permitting deterministic, unprivileged out-of-bounds reads and writes without KASLR interference.
3VM Escape Vector Path
The second vector targets virtual machines running with virtual IOMMU enabled in device-IOTLB mode. An untrusted guest triggers out-of-bounds writes directly into the host QEMU process. By overwriting execution function pointers within QEMU memory, an isolated guest can execute arbitrary host instructions or crash the underlying virtualization layer.
4Interaction of Layered Commits
The vulnerability resulted from two separate legitimate patches over time. A 2017 commit introduced mapping shortcut caching, while a 2020 change deferred address verification routines. This separation allowed live ring reconfigurations to reuse stale cache entries silently. The subtle logic flaw remained completely hidden across mainline trees for nine years.
5Distribution Impact Across Distros
Tencent verified exploits on Ubuntu, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0, and Oracle Linux 10.2. While Ubuntu restricted device access to the kvm group, other distributions left nodes like /dev/vhost-net open at mode 0666. World-accessible permissions allow any local system account to execute the exploit immediately.
6AI-Driven Vulnerability Discovery
Discovery was driven by Corvus AI, Tencent's multi-agent kernel analysis framework, which received upstream commit credit. This represents machine-assisted defensive research rather than automated adversary tooling. The same pipeline uncovered an 18-year-old SCTP protocol bug in August, highlighting the growing efficacy of automated vulnerability discovery in legacy subsystems.
7Severity Scoring Discrepancies
Industry vendors disagree on the CVSS score for the vulnerability. The kernel.org security team rated it 8.8 due to cross-boundary host escapes. In contrast, Red Hat and Oracle scored it 7.3, treating execution impact within the local trust boundary. Amazon independently evaluated the flaw at a 7.8 rating.
8Mitigation and Patch Guidance
Upstream commit de845981da67 invalidates the translation cache whenever rings reconfigure. Administrators must deploy patched kernels across enterprise fleets immediately. Until reboots occur, teams should restrict access permissions on /dev/vhost-net and /dev/vhost-vsock nodes. The guest escape vector lacks workarounds and strictly requires a patched, rebooted host kernel.