Privilege Escalation Vulnerability in Linux Kernel vhost Subsystem (CVE-2026-74580)

CVE-2026-74580 is a high-severity vulnerability (CVSS 8.8) affecting the Linux kernel vhost subsystem. The flaw exists in the vhost_vq_meta_fetch() function, where a lack of range validation allows for out-of-bounds data access. The issue stems from the fact that VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM operations do not correctly reset the vq->meta_iotlb[] cache when device IOTLB is active. An attacker with local access to the /dev/vhost-vsock device node can leverage this stale cache to perform unauthorized memory operations. Public proof-of-concept (PoC) code is available, which confirms that an attacker can successfully escalate privileges to obtain a root shell. The impact is significant for multi-tenant environments or systems where untrusted users have access to device nodes or kernel-level interfaces.

Attack Chain

1. Attacker gains local user access to the Linux system.
2. Attacker checks for the presence of the /dev/vhost-vsock device node (typically owned by root:kvm or accessible via 0666 permissions).
3. Attacker compiles the PoC exploit source code (cc -O2 -Wall -Wextra -o poc poc.c).
4. Attacker executes the poc binary, which triggers the out-of-bounds access in the kernel via ioctl calls to /dev/vhost-vsock.
5. The exploit leverages the stale IOTLB cache to bypass memory protections.
6. The exploit performs memory corruption to modify the kernel's execution flow or data structures (such as modprobe_path).
7. The exploit creates a setuid root file (e.g., /tmp/sh) to persist the escalated privileges.
8. Attacker executes the setuid file to obtain a root shell (euid=0).

Impact

The vulnerability allows an unprivileged local user to achieve full root privileges on the affected host. This presents a critical risk in cloud environments, containerized infrastructure, or any multi-user Linux system where an attacker can interact with the vhost subsystem. Success leads to total system compromise, including the ability to exfiltrate sensitive data, disable security controls, or persist within the environment.

Recommendation

Prioritize patching the Linux kernel on all systems that expose the vhost-vsock interface.

• Apply the kernel fix provided in commit de845981da67a6b049080c87e605130b0c30adc5 to the affected Linux kernel version.
• Restrict access to /dev/vhost-vsock by ensuring appropriate permissions (not 0666) and limiting access to trusted users/groups (kvm group).
• Use monitoring to detect the creation of setuid binaries in temporary directories, specifically targeting patterns where binaries are dropped by compilers or during privilege escalation attempts.