AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A critical vulnerability in the Linux kernel's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local unprivileged users to achieve root privilege escalation by exploiting a flaw in memory mapping validation. The vulnerability also enables a virtual machine guest to break out to the host by writing to the host's memory via a QEMU process hijack when specific virtualization configurations are used. The bug existed due to a cache inconsistency introduced across two code changes in 2017 and 2020, affecting kernels from version 4.11 to 7.2-rc4. Tencent Zhuque Lab discovered the flaw using an AI-assisted research pipeline called Corvus AI and released a fix in August 2026, with a public write-up and working demos provided in October.

AI-extracted · verify before operational use