CVE-2026-74580 Overview
CVE-2026-74580 is a Linux kernel vulnerability in the vhost subsystem. The flaw allows a local, low-privileged user with access to a vhost device to trigger out-of-bounds memory access through a stale vring metadata cache. When the vring is reconfigured through VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM, the vq->meta_iotlb[] cache is not reset. As a result, iotlb_access_ok() returns early on cache hits and skips validation, causing vhost_copy_to_user() and vhost_copy_from_user() to translate addresses through a mapping that no longer covers them.
Critical Impact
A local attacker with access to a vhost device and an attached device IOTLB can read from or write to kernel memory outside the intended vring region, leading to guest-to-host memory corruption or information disclosure.
Affected Products
- Linux kernel builds that include the vhost subsystem with device IOTLB support
- Distributions shipping affected kernels prior to the fixes referenced in the stable patches
- Hypervisor and virtualization hosts using vhost-net, vhost-vsock, or related vhost back-ends
Discovery Timeline
- 2026-08-21 - CVE-2026-74580 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74580
Vulnerability Analysis
The vhost driver maintains a per-vring metadata cache, vq->meta_iotlb[], that stores the vhost_iotlb_map backing each vring metadata region. On a lookup, iotlb_access_ok() checks the cache first and returns true on a hit, treating the hit as evidence that the region has already been validated.
The cache is invalidated on VHOST_IOTLB_UPDATE, VHOST_IOTLB_INVALIDATE, device IOTLB reinitialization, and vq reset. It is not invalidated when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail, and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes. Both ioctls are accepted while the vq is live when a device IOTLB is attached.
Because vq_access_ok() and vq_log_used_access_ok() treat the supplied addresses as GIOVAs and defer validation to prefetch time, a stale cache entry causes vq_meta_prefetch() to short-circuit. Subsequent vhost_copy_to_user() and vhost_copy_from_user() calls use __copy_to_user() and __copy_from_user() on translated addresses that fall outside the region the IOTLB actually maps.
Root Cause
The root cause is missing cache invalidation on vring reconfiguration. The metadata cache lifecycle does not track changes to vq->desc, vq->avail, vq->used, or vring sizes, breaking the invariant that a cache hit implies a validated mapping. Address translation then proceeds as map->addr + addr - map->start for an address no longer covered by the mapping.
Attack Vector
Exploitation requires local access to a vhost device with an attached device IOTLB, typically available to a guest driving a virtio back-end or to a privileged user inside a virtualization host. The attacker populates the metadata cache, then issues VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM to change the vring layout without triggering cache invalidation. Descriptor fetches or used-ring updates then read or write memory beyond the newly configured region.
No verified public proof-of-concept is available. See the upstream fixes for technical details, including Kernel Patch 13fa6f32 and Kernel Patch cf363a7a.
Detection Methods for CVE-2026-74580
Indicators of Compromise
- Unexpected kernel oops, general protection fault, or KASAN reports referencing vhost_copy_to_user, vhost_copy_from_user, vhost_vq_meta_fetch, or iotlb_access_ok.
- Guest processes issuing VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctls on a live vq that has a device IOTLB attached.
- Host memory corruption or crashes correlated with virtio device activity from a specific guest.
Detection Strategies
- Enable KASAN and lockdep on test kernels to catch out-of-bounds reads and writes originating in drivers/vhost/.
- Audit ioctl() telemetry from processes with /dev/vhost-* handles for repeated VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM calls on active virtqueues.
- Correlate host dmesg kernel traces with guest lifecycle events to flag anomalous virtio reconfiguration patterns.
Monitoring Recommendations
- Forward host kernel logs and audit records to a centralized analytics platform for retention and correlation across the fleet.
- Alert on kernel panics or oops entries that reference vhost symbols, especially on hypervisor hosts running untrusted guests.
- Track kernel package versions across virtualization hosts to identify systems still exposed to CVE-2026-74580.
How to Mitigate CVE-2026-74580
Immediate Actions Required
- Apply the upstream stable kernel patches that reset the vq->meta_iotlb[] cache on vring reconfiguration.
- Update virtualization hosts to a distribution kernel that includes the fix, then reboot to activate the patched image.
- Restrict access to /dev/vhost-* devices to trusted users and virtualization services only.
Patch Information
The fix resets the metadata cache whenever the vring is reconfigured, forcing new addresses back through the iotlb_access_ok() slow path. Fixes are available across multiple stable branches. Reference commits: Kernel Patch 13fa6f32, Kernel Patch 5224bd37, Kernel Patch 54617e91, Kernel Patch 6fa3e9b1, Kernel Patch b70ebe0b, Kernel Patch cf363a7a, Kernel Patch de845981, and Kernel Patch f1e21108.
Workarounds
- Where patching is not immediately possible, avoid attaching a device IOTLB to vhost back-ends serving untrusted guests.
- Limit which users and services can open /dev/vhost-net, /dev/vhost-vsock, and related device nodes using file permissions and namespace isolation.
- Consider disabling vhost acceleration for guests that do not require it, falling back to userspace virtio paths on affected hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
