CVE-2026-74580

A flaw was found in the Linux kernel's vhost subsystem. A local attacker could exploit this vulnerability by reconfiguring a virtual ring (vring) using specific ioctl commands while a device Input/Output Memory Management Unit (IOTLB) is attached. This improper handling of the vring metadata cache can lead to out-of-bounds memory access, potentially resulting in information disclosure, data corruption, or a denial of service.

This vulnerability is rated as Important because an attacker with access to vhost device nodes can corrupt host kernel memory, compromising system integrity and virtualization isolation boundaries. Triggering the flaw requires reconfiguring virtual rings via device control operations while an active device IOTLB mapping is attached, limiting the attack surface to virtualization hosts running accelerated virtio devices. Environments that do not host virtual machines or do not expose vhost character devices to untrusted processes are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the vhost kernel module from loading on systems where kernel-accelerated virtio is not required.

1. Add a configuration entry in /etc/modprobe.d to disable autoloading:

echo "install vhost /bin/true" > /etc/modprobe.d/disable-vhost.conf

2. If the module is already loaded and no guests are using it, unload the vhost drivers:

modprobe -r vhost_net vhost_vsock vhost_scsi vhost

Caveats: Disabling vhost prevents in-kernel acceleration for virtio networking, storage, and vsock communication, which may degrade I/O performance or cause virtual machine instances dependent on vhost devices to fail to start.

Warning: A system reboot or stopping active virtual machines is required if the driver is currently loaded and actively in use.