A Linux Kernel Bug Called Vghost Lets a Guest VM Reach Into the Host

Key points

• Tencent's Zhuque Lab found a Linux kernel flaw, nicknamed Vghost and tracked as CVE-2026-74580, that lets a local user read and write kernel memory and gain root.
• In a virtualisation setup, an untrusted virtual machine can use the bug to write into the host operating system's memory and take over the process running the VM.
• The fix is a one-commit kernel patch by Jun Yang of Tencent, merged on 3 August 2026 by maintainer Michael S. Tsirkin.
• NVD and Red Hat disagree on the severity score; Red Hat warns the bug can cause information disclosure, data corruption or a denial of service.
• Zhuque Lab says an in-house AI tool helped surface the flaw.

A flaw deep inside Linux has sat quietly in the kernel, the core of the operating system, for close to ten years. Researchers at Tencent's Zhuque Lab in Shenzhen found it; they call it Vghost, and it carries the identifier CVE-2026-74580. Jun Yang of Tencent wrote the fix, accepted by Red Hat's Michael S. Tsirkin, who maintains the affected code.

What is the bug, in plain terms?

It's a mistake in how the kernel remembers where a virtual machine's shared memory lives. Vhost, the piece of Linux that moves data quickly between a virtual machine and the host computer it runs on, keeps a small cache of memory addresses so it doesn't have to look them up every time. When a program reconfigures the virtual machine's ring buffers, the shared queues that pass data back and forth, that cache isn't cleared. The kernel keeps trusting the stale entry and reads or writes memory outside the region it was supposed to use, letting a local user reach kernel memory they've no business touching.

For a nurse or a shop owner, the short version: a program running on the machine, or a guest virtual machine on a server, can step outside its box.

How bad is it?

Two scorers disagree on exactly how bad. NVD classes it High with scope marked Changed, meaning the attack can affect components beyond the vulnerable one. Red Hat scores its own kernel builds lower, with scope Unchanged.

According to The Hacker News, which first wrote up the Zhuque findings in English, the lab demonstrated a guest-to-host escape: a hostile virtual machine writing into the host's memory and hijacking the QEMU process that runs it. That's the scenario cloud providers care about most. One tenant breaking out of their VM touches every other tenant on the same box. We covered a similar escape path in the Arm64 KVM layer in our 22 September report on CVE-2026-89775, and the Zapscape KVM bug we reported on 6 August showed the same guest-to-host breakout pattern. Vghost is the third such escape we've reported in under three months.

What should people actually do?

Update the Linux kernel on any machine you administer, especially servers running virtual machines. Your Linux laptop, your home NAS, your cloud VM will get a kernel update from its vendor; take it. Red Hat, Debian, Ubuntu and SUSE all ship from the same upstream fix.

Vghost needs a local account on the machine, or control of a guest VM on a host that uses vhost with a device IOTLB, a component that maps memory addresses for virtualised hardware. That narrows real exposure to multi-tenant servers and anywhere untrusted code runs inside a VM. On a single-user desktop the risk is lower, but patching is still the right call.

Should you worry about AI-assisted bug hunting?

Zhuque said publicly that an in-house AI tool helped surface this flaw. Our 28 July story on CVE-2026-53264 was an early sign of this trend. Expect more long-lived kernel bugs to emerge from AI-assisted auditing, and expect the scoring disagreements between vendors and NVD to keep happening while everyone works out what Changed scope really means for a shared cache.