oss-security mailing list: CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape
Oss-security mailing list has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from oss-security mailing list.
- Review affected versions in the advisory.
- Apply updates promptly.
Oss-security mailing list published a security advisory titled “CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape”.
At a glance
- Publisher
- oss-security mailing list
- CVEs
- CVE-2026-74580
What the advisory says
Posted by fourie on Oct 13 Hi all, We are disclosing Vghost (CVE-2026-74580), a stale IOTLB metadata-cache vulnerability affecting Linux vhost frontends. Impact ------ - Local user with access to /dev/vhost-* -> arbitrary kernel read/write -> root. - Guest using vIOMMU + iommu_platform + VIRTIO_F_RING_RESET -> QEMU heap overwrite, and control-flow hijacking. Bug --- vq->meta_iotlb[] caches the IOTLB mappings for the descriptor, available, and used rings....
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CVE-2026-74580
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
