● Covered by 1 source · 2 reportsHigh impact2 neutral
Linux Kernel Flaw Vghost (CVE-2026-74580) Allows Local Root and VM Escape
Key points
- Vghost (CVE-2026-74580) affects Linux vhost subsystem.
- Allows local users to gain root privileges.
- Enables VM escape to host in certain configurations.
- Impacts nearly a decade of Linux kernel versions.
- PwnEscape (CVE-2026-99999) is in the Linux kernel's networking code.
- PwnEscape allows VMs to read host memory, crash the host, and run code on it.
- PwnEscape was demonstrated against Vercel's live cloud sandboxes.
- Vercel confirmed the memory leak against its production sandboxes.
- Each packet sent by the guest could carry back about 32 bytes of the host's memory.
Critical Vulnerability Discovered in Linux Kernel
A significant security flaw, identified as Vghost and tracked as CVE-2026-74580, has been found in the Linux kernel's vhost subsystem. This vulnerability permits a local user to perform arbitrary kernel memory reads and writes, leading to root privilege escalation across Linux kernel versions spanning nearly a decade. Tencent Zhuque Lab discovered the flaw, releasing a fix on August 3 and a full technical write-up with proof-of-concept demos on October 12.
Impact on Virtualization Environments
Beyond local privilege escalation, Vghost also poses a threat in specific virtualization scenarios. When a virtual machine's virtio device is configured with a virtual IOMMU (iommu_platform enabled) and vhost operates in device-IOTLB mode, an untrusted guest VM can exploit the bug. This allows the guest to write out of bounds into the host's QEMU process, potentially enabling a VM escape by overwriting function pointers and taking control of the host process.
Technical Details of the Flaw
The vhost subsystem, which accelerates I/O for virtual machines and containers, maintains a cache of memory mappings. The vulnerability arises because this cache is not properly cleared when certain commands (VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM) modify a ring's addresses or size while the queue is active. In device IOTLB mode, these commands accept new addresses without immediate validation. Consequently, vhost continues to translate new addresses using outdated mappings, leading to out-of-bounds memory access when data is copied to or from the virtual ring, granting an attacker kernel read and write capabilities.
Origin and Longevity of the Bug
The flaw remained undetected for approximately nine years, resulting from the interaction of two separate code changes. A 2017 update (Linux 4.11) introduced the caching mechanism and its shortcut. A subsequent change in 2020 (Linux 5.9) relocated the address checking process. The combination of these two modifications created the conditions for the Vghost vulnerability to exist.
Updates
- PwnEscape (CVE-2026-99999) is in the Linux kernel's networking code.
- PwnEscape allows VMs to read host memory, crash the host, and run code on it.
- PwnEscape was demonstrated against Vercel's live cloud sandboxes.
- Vercel confirmed the memory leak against its production sandboxes.
- Each packet sent by the guest could carry back about 32 bytes of the host's memory.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub zhangutah/security-research CVE CVE-2026-745808.8 HIGH GitHub asi-alliance/OmegaClaw-Core GitHub torvalds/linux CVE CVE-2026-999999.3 CRITICALHow outlets covered it
A critical vulnerability, CVE-2026-99999 (PwnEscape), in the Linux kernel's networking code allows virtual machines to read host memory. This flaw was demonstrated against Vercel's live cloud sandboxes, confirming its potential impact on cloud environments where guest VMs share host resources.
A critical flaw, Vghost (CVE-2026-74580), in the Linux vhost subsystem allows local users to achieve root privileges and, in specific virtualization setups, enables virtual machines to escape to the host. The vulnerability affects nearly a decade of kernel versions and was discovered by Tencent Zhuque Lab, which released a fix and detailed write-up.