[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAHtpoa3MzvkdrmPCBNFyKojFDiQkvf2OiV4TigOJ+SWwMAttzg@mail.gmail.com>
Date: Wed, 14 Oct 2026 10:16:22 +0800
From: fourie <littleddfu@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape
Hi all,
We are disclosing Vghost (CVE-2026-74580), a stale IOTLB metadata-cache
vulnerability affecting Linux vhost frontends.
Impact
------
- Local user with access to /dev/vhost-* -> arbitrary kernel read/write -> root.
- Guest using vIOMMU + iommu_platform + VIRTIO_F_RING_RESET -> QEMU heap
overwrite, and control-flow hijacking.
Bug
---
vq->meta_iotlb[] caches the IOTLB mappings for the descriptor, available,
and used rings. VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM replace the
vring configuration without clearing that cache. A later cache hit skips
range validation and translates the new address through the old mapping:
translated = old_map->addr + new_addr - old_map->start
The translated pointer reaches unchecked raw_copy_to_user() or
raw_copy_from_user(). The defect comes from the interaction of f88949138058
(metadata cache) and 0210a8db2aec (deferred GIOVA validation).
Exploit chain outline
---------------------
The completed local chain:
ATTACKER (uid=1000) VHOST / KERNEL
| |
| configure device IOTLB + vrings |
|------------------------------------>|
| kick queue: prime meta_iotlb[] |
|------------------------------------>|
| |
| VHOST_SET_VRING_ADDR |
| (new address, stale cache kept) |
|------------------------------------>|
| |
| repoint desc ring + kick |
|------------------------------------>| read target as desc[0]
|<------------------------------------| IOTLB_MISS leaks 8 bytes
| |
| read IDT[0] |
|------------------------------------>| recover KASLR slide
| |
| repoint used ring + kick |
|------------------------------------>| write vring_used_elem
| | to runtime modprobe_path
| |
| trigger request_module() |
|------------------------------------>| execute memfd payload
|<------------------------------------| uid=0(root)
| |
| restore modprobe_path |
|------------------------------------>|
The guest-triggered path:
UNTRUSTED GUEST QEMU / VHOST
| |
| prime used-ring metadata cache |
|------------------------------------>|
| queue_reset + new queue address |
|------------------------------------>| VHOST_SET_VRING_ADDR
| queue_enable + kick | (stale cache survives)
|------------------------------------>|
| | used-ring write escapes
| | guest RAM into QEMU heap
| v
| crash / QOM table corruption
| |
| controlled QEMU RIP
CVSS assessment
---------------
CVSS v3.1 Base Score: 8.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix
---
The upstream fix resets the vring metadata cache from
vhost_vring_set_num_addr(), forcing reconfigured addresses through IOTLB
validation again:
https://git.kernel.org/linus/de845981da67a6b049080c87e605130b0c30adc5
The first fixed upstream stable releases identified for the affected series
are:
5.10.265
5.15.216
6.1.183
6.6.152
6.12.104
6.18.45
7.1.9
7.2
Vendor kernels may contain a backport while retaining an older base version.
Tested distributions
--------------------
We reproduced the complete local-user-to-root chain with the same generic
x86-64 exploit on:
- Ubuntu 26.04 LTS, 7.0.0-28-generic
- RHEL 9.8, 5.14.0-687.5.3.el9_8.x86_64
- Amazon Linux 2023.12.20260817, 6.1.180-225.360.amzn2023.x86_64
- Microsoft Azure Linux 3.0, 6.6.150.1-1.azl3
- Oracle Linux 10.2, 6.12.0-204.92.4.2.el10uek
The tested Ubuntu image exposed /dev/vhost-vsock as 0660 root:kvm. The tested
RHEL 9.8, Amazon Linux, Azure Linux, and Oracle Linux images exposed it as 0666,
making the local chain reachable by an ordinary user. In every retained test,
modprobe_path was restored and the temporary root helper was removed.
Mitigation
----------
Apply a kernel containing the upstream fix or the corresponding vendor
backport, and reboot into that kernel.
Until then, restrict access to all vhost device nodes, including
/dev/vhost-net, /dev/vhost-vsock, /dev/vhost-scsi, and /dev/vhost-vdpa-*;
prevent untrusted containers from receiving them; and treat membership in a
device-owning group such as kvm as privileged. Permission changes do not
revoke already-open file descriptors and do not address the guest-triggered
path. For unpatched virtualization hosts, avoid exposing vhost devices with
iommu_platform behind a vIOMMU to untrusted guests.
References
----------
Technical write-up:
https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580
PoC:
https://github.com/zhangutah/security-research/tree/main/pocs/linux/cve-2026-74580
Linux kernel CVE announcement:
https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/
Mainline fix:
https://git.kernel.org/linus/de845981da67a6b049080c87e605130b0c30adc5
Amazon Linux advisory:
https://explore.alas.aws.amazon.com/CVE-2026-74580.html
Oracle Linux errata:
https://linux.oracle.com/errata/ELSA-2026-500248.html
Corvus AI assisted with source analysis, reproduction, exploit development,
and cross-platform validation.
Regards,
Fourie Zhang
TencentOS Security Team (Tencent Zhuque Lab)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
