Linux Kernel Flaw Found by AI Lets Local Users Gain Root and Escape Virtual Machines

The Flaw: What Researchers Found

A security flaw in the Linux kernel's vhost subsystem allows local users to read and write kernel memory, giving them a way to become root. In some virtualisation setups, an attacker inside a virtual machine (VM) can exploit the same bug to write into the host's memory, potentially taking control of the host system. The flaw, tracked as CVE-2026-74580 and named "Vghost," was discovered by Tencent Zhuque Lab with help from their Corvus AI system. The researchers released a fix on 3 August 2026 and published a detailed write-up on 12 October, including working demonstrations of both attacks. So far, there is no public sign that the flaw has been exploited in the wild.The Hacker News↗ (opens in a new tab)

Who Is Affected and How

The flaw affects Linux kernel versions from 4.11 up to 7.2-rc4. Tencent tested the exploit on five major distributions: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On most of these, any local user could access the vulnerable device node. On Ubuntu, only users in the "kvm" group could reach it, limiting the risk to those with that group membership. In virtualisation environments using a specific setup (virtio device behind a virtual IOMMU with iommu_platform enabled and vhost in device-IOTLB mode), an attacker in a guest VM can exploit the bug to write outside the intended memory region, hijacking the host's QEMU process.

How the Attack Works

The vulnerability is in how vhost manages its cache of memory mappings for virtual rings (the shared queues used to move data between host and guest). When certain commands change the ring's address or size while it is live, the cache is not cleared. This lets an attacker fill the cache with old mappings, then change the addresses, bypassing later checks. The kernel then copies data to or from the wrong memory region, giving the attacker read and write access to kernel memory. For the guest-to-host attack, the same flaw lets a guest VM write into the host's QEMU process memory, potentially taking control or crashing it.

Fixes and Mitigation

The fix clears the cache whenever the ring is reconfigured. Red Hat, Amazon Linux, and Oracle Linux have shipped patches. Ubuntu has fixed 22.04, but fixes for 24.04 and 26.04 are still in progress as of mid-October 2026. Until a fixed kernel is installed, administrators should restrict access to the vhost device nodes (/dev/vhost-net and /dev/vhost-vsock), removing world access and limiting group ownership to trusted services. There is no workaround for the guest-to-host escape; only patching the kernel will close that path.

Severity and Scoring

The flaw is rated high severity, but not critical. The kernel.org CVE team scores it 8.8 (out of 10), noting that the guest-to-host attack crosses a security boundary. Red Hat rates it 7.3, treating the impact as staying within the host. Amazon and Oracle rate it 7.8 and 7.3, respectively. The difference in scores reflects debate over how much risk the guest-to-host path poses in real-world setups.

The Role of AI in Discovery

Tencent's Corvus AI system helped find the flaw. This is an example of machine-assisted research, not an AI-driven attack. The same team and AI pipeline previously found another major kernel flaw affecting containers.

What Should Users and Admins Do?

If you run Linux systems, check your kernel version and apply updates as soon as they are available. For now, restrict access to the vhost device nodes. If you manage virtual machines, be aware that only a patched kernel fully closes the guest-to-host escape route. Watch for updates from your Linux distribution and apply them promptly.