Threat reportVulnerabilityTL-2026-3525

CVE-2026-74580: Linux vhost IOTLB Cache Flaw Enables Root Privilege Escalation and VM Escape (Public PoC)

highACTIVE

CVE-2026-74580 (TL-2026-3525), also tracked as Vghost, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-14. It has no confirmed attribution, affects Linux Linux kernel (vhost subsystem), references 1 CVE (CVE-2026-74580), maps to 5 MITRE ATT&CK techniques (T1059.004, T1082, T1106), and is covered by 9 detection rules and 9 indicators of compromise.

CVSS
8.8/10High
CVEs
1Referenced vulnerabilities
Techniques
5MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
9Indicators of compromise

Key facts for TL-2026-3525

Threat ID
TL-2026-3525
Also known as
Vghost
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
cloud, technology, telecoms, hosting
Target regions
Global
Detection rules
9
Indicators of compromise
9

Malware and tooling in CVE-2026-74580

Malware and tooling: root

How CVE-2026-74580 works

The Linux kernel vhost subsystem does not reset its vring metadata IOTLB cache when a virtual ring is reconfigured, so stale cache entries bypass address validation. A public PoC from Tencent Zhuque Lab (TencentOS Security Team) demonstrates local root privilege escalation via kernel memory read/write and, under specific vIOMMU conditions, VM escape through QEMU heap corruption.

CVE-2026-74580 (nicknamed 'Vghost' in Tencent Cloud's announcement) is a flaw in the Linux kernel vhost subsystem. The per-virtqueue cache vq->meta_iotlb[] stores the vhost_iotlb_map backing each vring metadata region (descriptor, available and used rings). The cache is reset on some operations but not when the VHOST_SET_VRING_ADDR ioctl replaces vring addresses or when VHOST_SET_VRING_NUM changes region sizes. Once the cache is populated, deferred validation no longer runs and vhost_vq_meta_fetch() keeps translating through the old mapping for an address that mapping no longer covers, using translated = old_map->addr + new_addr - old_map->start. A subsequent used-ring update or descriptor fetch therefore reads or writes memory outside the region the IOTLB actually maps. The fix resets the metadata cache on vring reconfiguration so new addresses go back through the iotlb_access_ok() slow path.

Local privilege escalation: a local attacker with access to a vhost device node (/dev/vhost-net, /dev/vhost-vsock, and per the advisory also /dev/vhost-scsi and /dev/vhost-vdpa-*) configures the device IOTLB and vrings and primes the metadata cache with a queue kick. The attacker then issues VHOST_SET_VRING_ADDR with a new address while the stale cache is retained, repoints the descriptor ring and triggers an IOTLB miss to leak 8 bytes of kernel memory, and reads IDT[0] to recover the KASLR offset. Next, the used ring is repointed so a vring_used_elem write lands on modprobe_path, and the attacker triggers request_module() so the kernel executes an attacker-chosen payload as root. Red Hat confirmed local privilege escalation on RHEL 9.8.

VM escape: this requires a virtual IOMMU with iommu_platform and the VIRTIO_F_RING_RESET feature. A guest-triggered queue reconfiguration leaves a stale mapping that can send a used-ring write beyond guest memory and into the QEMU process heap, risking QEMU corruption or control-flow hijacking on the host. The article describes this as possible only under specific conditions.

The PoC was published on 2026-10-14 by Fourie Zhang of the TencentOS Security Team (Tencent Zhuque Lab), with help from Corvus AI for analysis and exploit development, and was tested on Ubuntu 26.04 LTS (7.0.0-28-generic), RHEL 9.8 (5.14.0-687.5.3.el9_8), Amazon Linux 2023 (6.1.180), Azure Linux 3.0 (6.6.150.1) and Oracle Linux 10.2 (6.12.0-204.92.4.2.el10uek). Affected kernels run from 4.11 through the pre-fix point releases of each stable branch. Fixes are in 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. The sources do not state in-the-wild exploitation; EPSS was 0.00121 at the time of review.

MITRE ATT&CK techniques used in TL-2026-3525

Execution

T1059.004 Unix Shell; T1106 Native API

Discovery

T1082 System Information Discovery

Defense Evasion

T1574 Hijack Execution Flow

Privilege Escalation

T1611 Escape to Host

Affected products and versions in CVE-2026-74580

  • Linux — Linux kernel (vhost subsystem)
    Vulnerable versions: 4.11 through 5.10.264; 5.15 through 5.15.215; 6.1 through 6.1.182; 6.6 through 6.6.151; 6.12 through 6.12.103; 6.18 through 6.18.44; 7.1 through 7.1.8
    Fixed in: 5.10.265; 5.15.216; 6.1.183; 6.6.152; 6.12.104; 6.18.45; 7.1.9; 7.2
  • Red Hat — Red Hat Enterprise Linux
    Vulnerable versions: 7; 8; 9 (PoC tested on 9.8); 10
    Fixed in: See RHSA-2026:62568, RHSA-2026:81349, RHSA-2026:81371
  • Canonical — Ubuntu LTS
    Vulnerable versions: 18.04 through 26.04
  • Tencent — TencentOS Server
    Vulnerable versions: 2.x; 3.x; 4.x

Remediation for CVE-2026-74580

Patches

  • Upgrade to Linux kernel 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 or 7.2 or later
  • Red Hat: RHSA-2026:62568, RHSA-2026:81349, RHSA-2026:81371
  • Mainline fix commit de845981da67a6b049080c87e605130b0c30adc5

Immediate actions

  • Restrict /dev/vhost-net, /dev/vhost-vsock, /dev/vhost-scsi and /dev/vhost-vdpa-* to root:kvm with mode 0660 via udev rules
  • Do not pass vhost device nodes into untrusted containers
  • Treat membership of the vhost device-owning group as privileged
  • Do not expose vhost devices with virtual IOMMU (iommu_platform, VIRTIO_F_RING_RESET) to untrusted guests

Workarounds

  • echo 'install vhost /bin/true' > /etc/modprobe.d/disable-vhost.conf (Red Hat; does not affect already-loaded modules or cover every loading path)

Longer-term hardening

  • Monitor for VHOST_SET_VRING_ADDR/VHOST_SET_VRING_NUM ioctl use and modprobe_path tampering from non-virtualization processes
  • Inventory hosts that load the vhost, vhost_net or vhost_vsock modules

CVEs associated with CVE-2026-74580

CVE-2026-74580

Timeline of CVE-2026-74580

  • Stable kernel fix commits referenced in NVD, including mainline de845981da67a6b049080c87e605130b0c30adc5
  • CVE-2026-74580 published in NVD and opened in Red Hat Bugzilla (2521055) with the upstream fix 'vhost: reset the vring metadata cache on vring reconfiguration'
  • Tencent Cloud published an announcement on CVE-2026-74580 ('Vghost') with affected versions and udev-based device restrictions
  • Red Hat shipped RHSA-2026:62568, RHSA-2026:81349 and RHSA-2026:81371; Red Hat confirmed local privilege escalation on RHEL 9.8
  • Cyber Security News reported the PoC for root privilege escalation and VM escape; NVD and Tenable records were updated the same day
  • Fourie Zhang (TencentOS Security Team / Tencent Zhuque Lab) published the technical analysis on oss-security and a public PoC on GitHub

Sources cited for CVE-2026-74580

Detection coverage for TL-2026-3525

As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3525 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
9 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats