Kernel Linux · Public exploit code

PoC released: Linux vhost flaw lets local attacker corrupt host kernel

Nov 04, 2026 · 1 min read

A flaw in the Linux kernel vhost subsystem (CVE-2026-74580, CVSS 8.8) lets a local attacker corrupt host kernel memory by reconfiguring a vring with a device IOTLB attached, due to stale vring metadata caching, and escalate privileges across virtualization boundaries. A PoC has been published and demonstrates the issue against multiple RHEL 9 and RHEL 10 kernel builds. Vendor-specific patched kernel releases are available; apply your distribution update.

By HIFY Radar newsroom Updated 11/04/2026 07:44 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A flaw in the Linux kernel vhost subsystem (CVE-2026-74580) allows a local user to corrupt host kernel memory, escalate privileges and cross virtualization boundaries. A proof of concept has been published and demonstrates the issue against RHEL 9 and RHEL 10 kernel builds. Vendor-specific patched kernels are already available.

Why it matters

On virtualization servers, an attacker with limited local access can compromise the host and every virtual machine it runs. Any company running virtualized workloads on affected Linux kernels is exposed.

What to do

Apply your distribution's patched kernel to virtualization servers as soon as possible. Restrict vhost device permissions to trusted users and processes.

For the technical team

CVE: CVE-2026-74580
Affected: Kernel Linux (subsistema vhost) · Multiple Linux kernel versions using vulnerable vhost implementations; the PoC demonstrates against multiple RHEL 9 and RHEL 10 kernel builds.
Exploitation: Public PoC: the exploit repository demonstrates the issue against multiple RHEL 9 and RHEL 10 kernel builds and includes automated checks for vulnerable kernel versions and required vhost device permissions (reported by @DarkWebInformer). No in-the-wild exploitation reported in the source.
Fix: Vendor-specific patched kernel releases are available, per the source; apply your distribution's update.
Vector: Linux kernel vhost subsystem: stale vring metadata caching. Reconfiguring a vring while a device IOTLB is attached causes out-of-bounds memory access and host kernel memory corruption. Requires a local attacker with vhost device permissions.
More details: CVE-2026-74580, CVSS 8.8 High. Reported impact: local privilege escalation and host kernel compromise. Source: @DarkWebInformer post.