# CVE-2026-74580: Linux vhost IOTLB Cache Flaw Enables Root Privilege Escalation and VM Escape (Public PoC)

> The Linux kernel vhost subsystem does not reset its vring metadata IOTLB cache when a virtual ring is reconfigured, so stale cache entries bypass address validation. A public PoC from Tencent Zhuque Lab (TencentOS Security Team) demonstrates local root privilege escalation via kernel memory read/write and, under specific vIOMMU conditions, VM escape through QEMU heap corruption.

- **Published:** 2026-10-14T16:42:22Z
- **Last reviewed:** 2026-10-14T16:42:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3525
- **ID:** TL-2026-3525
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-74580

## Description

CVE-2026-74580 (nicknamed 'Vghost' in Tencent Cloud's announcement) is a flaw in the Linux kernel vhost subsystem. The per-virtqueue cache vq->meta_iotlb[] stores the vhost_iotlb_map backing each vring metadata region (descriptor, available and used rings). The cache is reset on some operations but not when the VHOST_SET_VRING_ADDR ioctl replaces vring addresses or when VHOST_SET_VRING_NUM changes region sizes. Once the cache is populated, deferred validation no longer runs and vhost_vq_meta_fetch() keeps translating through the old mapping for an address that mapping no longer covers, using translated = old_map->addr + new_addr - old_map->start. A subsequent used-ring update or descriptor fetch therefore reads or writes memory outside the region the IOTLB actually maps. The fix resets the metadata cache on vring reconfiguration so new addresses go back through the iotlb_access_ok() slow path.

Local privilege escalation: a local attacker with access to a vhost device node (/dev/vhost-net, /dev/vhost-vsock, and per the advisory also /dev/vhost-scsi and /dev/vhost-vdpa-*) configures the device IOTLB and vrings and primes the metadata cache with a queue kick. The attacker then issues VHOST_SET_VRING_ADDR with a new address while the stale cache is retained, repoints the descriptor ring and triggers an IOTLB miss to leak 8 bytes of kernel memory, and reads IDT[0] to recover the KASLR offset. Next, the used ring is repointed so a vring_used_elem write lands on modprobe_path, and the attacker triggers request_module() so the kernel executes an attacker-chosen payload as root. Red Hat confirmed local privilege escalation on RHEL 9.8.

VM escape: this requires a virtual IOMMU with iommu_platform and the VIRTIO_F_RING_RESET feature. A guest-triggered queue reconfiguration leaves a stale mapping that can send a used-ring write beyond guest memory and into the QEMU process heap, risking QEMU corruption or control-flow hijacking on the host. The article describes this as possible only under specific conditions.

The PoC was published on 2026-10-14 by Fourie Zhang of the TencentOS Security Team (Tencent Zhuque Lab), with help from Corvus AI for analysis and exploit development, and was tested on Ubuntu 26.04 LTS (7.0.0-28-generic), RHEL 9.8 (5.14.0-687.5.3.el9_8), Amazon Linux 2023 (6.1.180), Azure Linux 3.0 (6.6.150.1) and Oracle Linux 10.2 (6.12.0-204.92.4.2.el10uek). Affected kernels run from 4.11 through the pre-fix point releases of each stable branch. Fixes are in 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. The sources do not state in-the-wild exploitation; EPSS was 0.00121 at the time of review.

## MITRE ATT&CK

- T1611 Escape to Host
- T1574 Hijack Execution Flow
- T1106 Native API
- T1059.004 Unix Shell
- T1082 System Information Discovery

## Sources

- [PoC Released for Linux Vhost Flaw Enabling Root Privilege Escalation and VM Escape](https://cybersecuritynews.com/poc-released-for-linux-vhost-flaw/)
- [oss-security: CVE-2026-74580 Linux vhost stale IOTLB metadata cache (Fourie Zhang, Tencent Zhuque Lab)](http://www.openwall.com/lists/oss-security/2026/10/14/2)
- [CVE-2026-74580 PoC (zhangutah/security-research)](https://github.com/zhangutah/security-research/tree/main/pocs/linux/cve-2026-74580)
- [NVD: CVE-2026-74580](https://nvd.nist.gov/vuln/detail/CVE-2026-74580)
- [Tenable: CVE-2026-74580](https://www.tenable.com/cve/CVE-2026-74580)
- [Red Hat Bugzilla 2521055: kernel: vhost: reset the vring metadata cache on vring reconfiguration](https://bugzilla.redhat.com/show_bug.cgi?id=2521055)
- [Tencent Cloud announcement: CVE-2026-74580 (Vghost) Linux kernel vhost privilege escalation](https://cloud.tencent.com/announce/detail/2483)
- [Linux kernel mainline fix: vhost reset vring metadata cache](https://git.kernel.org/linus/de845981da67a6b049080c87e605130b0c30adc5)
- [Oracle Linux: CVE-2026-74580](https://linux.oracle.com/cve/CVE-2026-74580.html)
- [TuxCare CVE tracker: CVE-2026-74580](https://tuxcare.com/cve-tracker/cve/details/cve-2026-74580/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3525