Vghost: Tencent's AI Finds Linux Kernel vhost Flaw in Two Hours

On October 12, 2026, Tencent Zhuque Lab disclosed CVE-2026-74580, nicknamed Vghost, a vulnerability in the Linux kernel vhost subsystem discovered with the assistance of Corvus AI, Tencent's multi-agent system for kernel vulnerability research. The flaw allows local privilege escalation to root and, in virtualized configurations with virtual IOMMU, guest-to-host escape. The claimed discovery speed — roughly two hours — and the release of a deterministic proof-of-concept make the risk immediate for cloud and on-premise infrastructure.

How the Stale Cache Compromises the Kernel

The flaw resides in the vq->meta_iotlb[] cache, which holds IOTLB translations for vring metadata (desc, avail, used). This cache short-circuits validation on a cache hit: if the address is already present, the system does not revalidate. The problem is that VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM — the ioctl commands that reconfigure vring addresses — do not invalidate the cache.

With the IOTLB device attached, these ioctls accept new addresses on an already-live vq and defer validation to the prefetch stage. But prefetch never occurs if there is a cache hit. At that point vhost_vq_meta_fetch() computes the pointer via map->addr + addr - map->start without a range check, causing __copy_to_user and __copy_from_user to operate on arbitrary addresses.

According to Tencent Zhuque Lab's technical analysis, "the bug is the composition of two commits that are each individually reasonable." The combination of two individually correct behaviors — caching for performance and deferred validation for safety — creates a critical flaw when combined without invalidation.

From Local Root to Guest-to-Host: Vghost's Two Vectors

On the first vector, the local attack bypasses KASLR by reading the IDT gate 0. The exploit points desc_user_addr to a fixed address — 0xfffffe0000000000, corresponding to asm_exc_divide_error — and retrieves the first 8 bytes via the VHOST_IOTLB_MISS message, calculating the KASLR slide. Arbitrary write is then achieved by modifying used_user_addr with controlled alignment, overwriting /proc/sys/kernel/modprobe for code execution as root.

On the second vector, an untrusted guest with a virtio device behind a virtual IOMMU and iommu_platform enabled can force the host QEMU to invoke VHOST_SET_VRING_ADDR without clearing the cache. This permits out-of-bounds writes in the QEMU heap, overwriting function pointers in the QOM framework. The technical source defines this as "dual exploitation vectors: host local privilege escalation and virtual machine escape."

The PoC published by Fourie Zhang of the TencentOS Security Team confirms the exploit requires a single process, a short ioctl sequence, and no retry loop. The deterministic nature eliminates the variability typical of race conditions, making the attack repeatable and predictable.

"once the cache is populated, that deferred validation never runs: vq_meta_prefetch() hits the stale entry and returns true, and vhost_vq_meta_fetch() keeps translating the new address through the old mapping" — Tencent Zhuque Lab

How Exposed Is the Installed Base: Enterprise Distro Tests

Tencent reproduced the full attack on five distributions: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. The reproduction revealed a critical difference in default permissions for the /dev/vhost-net and /dev/vhost-vsock device nodes.

On four of the five distributions — RHEL, Amazon Linux, Azure Linux, and Oracle Linux — the devices are world-accessible with 0666 permissions. Any local process, even unprivileged, can open them and trigger the ioctl chain. On Ubuntu 26.04 the permissions are 0660 root:kvm, limiting the attack surface to members of the kvm group. This difference does not reduce the severity of the flaw but changes the practicality of exploitation in multi-user environments.

No signs of in-the-wild exploitation have emerged as of the October 12, 2026 disclosure. However, the PoC publication on GitHub increases the likelihood of replication.

What to Do Now

Red Hat, Amazon Linux, and Oracle Linux have released fixes; Ubuntu has patched 22.04 and is preparing updates for 24.04 and 26.04. Applying the upstream commit de845981da67 — which adds vring metadata cache invalidation in vhost_vq_set_addr() and vhost_vq_set_num() — is the documented mitigation.

On systems that cannot reboot immediately, restricting permissions on /dev/vhost-* device nodes to 0660 root:kvm reduces the attack surface for the first vector, though it does not mitigate the guest-to-host vector where device access is already mediated by the QEMU process. No documented workarounds exist for this second scenario.

Verifying the presence of the fix commit in the LTS versions in use is a priority: the roughly nine-year vulnerability window — from Linux 4.11 to 7.2-rc4 — means many potentially affected enterprise systems no longer receive updates from the original vendor and require case-by-case evaluation.

The dossier does not specify whether effective mitigations beyond the kernel patch exist for the guest-to-host vector, nor whether the fix has been backported to all affected LTS versions or only those listed by verified sources.

AI as Research Accelerator: From Fuzzing to Multi-Agent

The detail that distinguishes Vghost from standard kernel advisories is the claimed discovery time: roughly two hours with Corvus AI, with the Hy4-preview model integrated into the exploit verification and patch validation loop. The Hacker News clarified this is "machine-assisted research, not an attack run by AI," drawing a sharp line between the research tool and a hypothetical autonomous exploitation agent.

The Corvus AI methodology does not replace human analysis but compresses the time to identify the vulnerable surface and build the trigger. In the Vghost case, the system navigated the complexity of the vhost subsystem — which manages IOTLB translations, vring metadata, and virtio-guest interactions — pinpointing the composition of behaviors that escapes traditional testing.

This shifts the threat landscape calculus: if the discovery-to-PoC cycle compresses from weeks to hours, the time available to defensive teams for patching and incident response shrinks accordingly. The question is not whether AI will replace human researchers, but whether organizations are structured to absorb vulnerabilities discovered at this velocity.

Tencent's two-hour claim is not independently verified; the dossier does not clarify whether the time refers only to the identification phase or the entire pipeline including verification and reporting. Similarly, it does not indicate whether variants of the same bug class exist in similar kernel subsystems with translation caches that are not invalidated on reconfiguration.

Sources

• https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html
• https://www.rapid7.com/blog/post/ai-securing-agent-to-agent-communication-next-identity-frontier
• https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580
• https://mallory.ai/stories/01a1397e-3bd3-7fdb-9712-e6a9a04745a9
• https://securityonline.info/vghost-cve-2026-74580-linux-vhost-poc-disclosed/
• https://appleinsider.com/articles/26/07/27/claude-cowork-can-escape-its-sandbox-rummage-through-all-of-your-files
• https://the420.in/claude-cowork-sharedroot-sandbox-escape-macos-ai-agent-security-flaw/
• https://www.cve.org/CVERecord?id=CVE-2026-74580
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence

Information verified against cited sources and current as of publication.

Sources

• https://schema.org/FAQPage
• https://schema.org/Question
• https://schema.org/Answer