CVE-2026-74580 Vhost Cache Flaw Enables Deterministic Kernel R/W on Linux 4.11+

The bug resides in vhost's handling of virtio ring address updates. A 2017 cache addition and a 2020 move of address validation created a window where VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands update ring parameters without invalidating prior mappings. Subsequent data copies then use unchecked pointers, enabling reliable out-of-bounds access without grooming or timing. Tencent Zhuque Lab demonstrated both local-to-root and guest-to-host escapes when device IOTLB mode is active.

Evidence comes from the October 12 write-up and working PoCs on five distribution kernels: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0, and Oracle Linux 10.2. On four of those images the /dev/vhost-net node was world-readable; Ubuntu restricted it to the kvm group. No public exploitation has been observed, but the deterministic nature lowers the bar for in-the-wild use.

The nine-year latency reflects how incremental virtualization optimizations accumulate hidden state. The fix (commit de845981da67) simply clears the cache on ring reconfiguration and has landed in stable branches 5.10.265 onward. Until deployed, operators must restrict device node permissions rather than rely on kernel isolation.

Operational impact centers on multi-tenant hosts and container platforms that expose vhost. Future changes to virtio or IOMMU paths should be audited for similar cache-invalidation gaps before merge.