Critical Linux Kernel Vulnerability (CVE-2026-74580) Enables Privilege Escalation and Host Memory Access via vhost Subsystem

A critical vulnerability (CVE-2026-74580) in the Linux vhost subsystem enables local users to read/write kernel memory and escalate privileges to root across multiple kernel versions. It also allows untrusted virtual machines to access host memory, potentially hijacking the host's virtualization process.

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine.

The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the

Read original article