Linux vhost IOTLB cache flaw allows LPE and VM escape

A stale IOTLB metadata cache in Linux vhost frontends, tracked as CVE-2026-74580 and dubbed Vghost, allows a local user who can open /dev/vhost-* devices to obtain arbitrary kernel read and write primitives and escalate to root. The same defect can also be leveraged from a guest that uses a vIOMMU with iommu_platform and VIRTIO_F_RING_RESET, producing a QEMU heap overwrite and control-flow hijack that escapes the virtual machine.

Vhost caches IOTLB mappings for the descriptor, available, and used rings. Calls that replace vring address or size configuration leave that cache intact. A later hit then translates the new address through the old mapping, skipping range checks, so the resulting pointer is fed directly into unchecked kernel copy routines.

Fourie disclosed the issue on the oss-security list, outlining a local chain that primes the cache, repoints rings to leak kernel data (including KASLR material via the IDT), and finally overwrites sensitive kernel state such as modprobe_path. Guests meeting the vIOMMU prerequisites can drive a similar stale-cache path against the host QEMU process.

The vulnerability affects systems that expose vhost devices to untrusted local users or that run guests with the listed virtio and IOMMU features enabled. Operators should treat access to vhost character devices as equivalent to a high-privilege interface until patches land and should restrict or disable the affected guest configuration where VM isolation is required.