Vghost: A 9-year-old Linux vhost bug enabling local root and VM escape

A stale metadata-cache bug in Linux's vhost virtualization acceleration (tracked as CVE-2026-74580, CVSS 8.8) allows deterministic, race-free arbitrary kernel reads and writes from an unprivileged context. The defect arises when vq->meta_iotlb caches a vhost_iotlb_map and vhost_vq_meta_fetch() translates addresses without range checks; a later change that deferred GIOVA validation to prefetch time leaves the cache populated and never revalidated on VHOST_SET_VRING_ADDR. By repointing vring pointers, an attacker can force vhost to write crafted eight-byte used-ring entries to any kernel address (arbitrary write) or read eight bytes from any kernel address via an IOTLB-miss reporting path (arbitrary read). The read recovers the KASLR slide from IDT gate 0, enabling reliable symbol resolution and privilege escalation without heap grooming or racing.

The flaw affects vhost-net and vhost-vsock across kernels from 4.11 through 7.2 and was demonstrated on Ubuntu, RHEL, Amazon Linux, Azure Linux and Oracle Linux; exposure depends on /dev/vhost-* permissions (many images ship world-readable nodes). The same stale-cache path can be triggered from inside a guest when a device uses a device IOMMU and GIOVAs: VIRTIO_F_RING_RESET causes QEMU to repoint vrings without invalidating the cache, producing out-of-bounds used-ring writes into the host QEMU process heap and allowing overwrite of QEMU function pointers (VM escape). Upstream remediation is available (commit de845981da67).