Vghost: an AI tool found a 2017 Linux kernel flaw in two hours

01What happened

Tencent Zhuque Lab published the Vghost research on October 12, 2026, and Fourie Zhang of the TencentOS Security Team posted the disclosure to the oss-security list on October 14. The lab says its Corvus AI tool found the defect in about two hours, and that Tencent Hunyuan's Hy4-preview model took part in exploit verification and patch validation. Those claims come from Tencent and are not independently verified.

02How it works

The vhost driver caches IOTLB address translations for a virtqueue's descriptor, available and used rings. Two ioctls, VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM, replace that configuration without clearing the cache, and a later cache hit is treated as proof that the address was already validated. Stale translations then let the kernel read and write outside the intended range through __copy_to_user and __copy_from_user.

03Who is affected

Linux kernels from 4.11 through 7.2 carry the flaw, in drivers/vhost/vhost.c. Tencent reports that its exploit reached root on Ubuntu 26.04 LTS, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2, and that the difference between those systems was device node exposure: Ubuntu limits /dev/vhost-vsock to the kvm group, while the others left it mode 0666. The guest-to-host path needs device-IOTLB mode, a virtual IOMMU and iommu_platform.

04What to do

Install a kernel that contains commit de845981da67 or a vendor backport, then reboot into it. Until then, remove world access to /dev/vhost-net and /dev/vhost-vsock, keep untrusted containers from receiving those devices, and treat kvm group membership as privileged. Zhang notes that permission changes do not revoke file descriptors that are already open.

Questions people ask

Which Linux kernel versions fix CVE-2026-74580?

The Linux kernel CNA lists first fixed stable releases 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2 for CVE-2026-74580. Distribution kernels may carry the same fix backported onto an older base version, so check your vendor's changelog rather than the version number alone, and reboot afterwards, because a running kernel keeps the flaw.

Can a virtual machine guest escape to the host through Vghost?

Tencent Zhuque Lab reports a guest-to-host path, but only when the vhost device runs in device-IOTLB mode, the virtio device sits behind a virtual IOMMU, and iommu_platform is enabled. Under those settings a guest can make the host kernel write out of bounds into the QEMU process on the host. The lab says it controlled QEMU's instruction pointer in testing.

Was Vghost exploited before Tencent disclosed it?

Tencent Zhuque Lab reports no exploitation of Vghost. The fix reached mainline Linux on August 3, 2026, weeks before the October 12 write-up, and the lab published exploitation detail only after stable releases carried the patch. Neither the Tencent post nor the oss-security disclosure from Fourie Zhang mentions attacks in the wild against CVE-2026-74580.

Sources 4 links, all fetched

1. 1matrix.tencent.comTencent Write-Up
2. 2openwall.comoss-security Post
3. 3github.comKernel Fix Commit
4. 4cveawg.mitre.orgCVE Record