Tencent Lab Says AI Found 'Vghost' Linux Kernel Flaw That Gives Local Users Root, Fixed Since Aug. 3

A bug in the Linux kernel's vhost subsystem lets an unprivileged local user read and write kernel memory and become root. In one virtualization setup, it also lets an untrusted guest virtual machine corrupt memory in the host's QEMU process.

The flaw is tracked as CVE-2026-74580 and nicknamed Vghost. Tencent Zhuque Lab released a fix on August 3 and published its full technical write-up, with working demos of both attacks, on October 12. The kernel.org CNA rates it 8.8 (High) on the CVSS 3.1 scale. The upstream fix is commit de845981da67.

How the bug works

vhost accelerates network and other I/O for virtual machines and containers. A local user reaches it by opening a device node, typically /dev/vhost-net or /dev/vhost-vsock.

vhost keeps a small cache of the memory mappings behind each virtual ring's metadata. A cache hit is treated as proof the region was already validated. According to Tencent, that cache is cleared on IOTLB updates and invalidations and on queue reset, but not when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands change a live ring's address or size.

With a device IOTLB attached, those commands accept new addresses and put off the check until later. Once the cache is populated, that later check never runs. The kernel keeps translating new addresses through the old mapping and copies data with no bounds check.

The result, per Tencent, is a deterministic read/write primitive on any kernel address. It needs no heap grooming and no lucky timing, and it bypasses KASLR.

Two reasonable changes, one nine-year hole

No single commit created the problem. A 2017 change in Linux 4.11 added the cache and its shortcut. A 2020 change in Linux 5.9 moved address validation out of the ioctl and into a later step. Tencent calls the bug the composition of two commits that were each individually reasonable.

Affected kernels run from 4.11 up to 7.2-rc4. Tencent says it reproduced the full local-user-to-root chain on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0 and Oracle Linux 10.2.

On Ubuntu, the device node is limited to the kvm group, so the attacker has to start as a member of that group rather than as any user.

The VM escape

The second attack is narrower. It requires a virtio device behind a virtual IOMMU with iommu_platform on, and vhost running in device-IOTLB mode. Tencent says an untrusted guest can then trigger the same stale-cache condition via VIRTIO_F_RING_RESET and make the host kernel write out of bounds into the QEMU process heap.

Tencent says that lets a guest overwrite a function pointer in QEMU and steer where the host process runs next, or simply crash it. The Hacker News reported no public sign the flaw has been exploited in the wild.

Found by AI in two hours

Tencent says its Corvus AI system discovered the flaw in two hours, and that it folded Tencent Hunyuan's Hy4-preview model into exploit verification and patch validation. That is Tencent's own account of its tooling.

The lab drew a broader conclusion in its write-up. Its earlier SCTPhantom research demonstrated a container escape, and Vghost adds a virtual machine escape. In Tencent's words, this "reminds us that trusted security isolation boundaries may need to be reconsidered."

A second AI-found kernel bug

Vghost is not the only one. XBOW, an autonomous offensive-security company, disclosed CVE-2026-72018, rated 7.8 and patched in July. The bug sits in SMC-D, code originally built for IBM Z mainframes.

Recent kernels rebuilt SMC-D on an abstraction called DIBS and added a virtual device, dibs_loopback. That put the code on ordinary x86 machines. A missing bounds check lets an attacker with CAP_NET_ADMIN trigger a 16-byte zero write. XBOW aimed that write at the kernel's cred structure to set the effective UID to zero.

The numbers cut both ways. XBOW reported root on 22 of 100 boots, with the first success on the seventh. It tested on Ubuntu 24.04 with Linux 7.1.0-rc6 and kernel mitigations disabled. Reliability on a hardened production kernel may differ. XBOW said its AI handled most of the threat modeling, code auditing, discovery and validation, but humans still had to redirect it toward local privilege escalation.

XBOW's report says human reviewers had largely overlooked the code because the primitive looked too weak to matter. "But it wasn't," the report reads. "A 16-byte write became root."

The patch backlog

Depthfirst, an AI security company, warned about a week ago that "Containers are no longer a security boundary." Its report counts 5,976 unique Linux kernel vulnerabilities published since the start of 2026. It says major distributions are "lagging significantly in backporting patches," leaving "a massive backlog of unpatched bugs in production systems."

Containers and the host share one kernel. Any local-to-root bug therefore turns a compromised container into a compromised host and every tenant on it. Both bugs here require local access, but that is exactly the foothold a container attacker already has.

It is not yet clear how quickly distribution kernels will carry the Vghost fix. The upstream patch has been public since August 3, while the exploit demos have been public only since October 12. Administrators running vhost on the distributions Tencent tested will need to confirm their vendor kernels include commit de845981da67 or an equivalent backport.