CVE-2026-74580: Escalation via Vhost Metadata Caching

CVE-2026-74580 identifies a vulnerability in the Linux kernel vhost subsystem. The issue lies in the handling of the vring metadata cache, the data structures that control access to memory regions used by virtualization. When vring configuration is changed via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctls, the cache is not cleared, allowing memory access outside the legitimately mapped IOTLB region. This directly affects Linux hosts running virtual machines or containers with configured vhost devices.

The vulnerability is rated CVSS 8.8 in the HIGH range and enables local privilege escalation across virtualization boundaries. There is no public indicator of exploitation in GitHub repositories, however discussion signals have been observed on social platforms in the last 24 hours, with unverified references to proofs of concept. The technical status is confirmed: the resolution has been integrated into the official Linux kernel through cache reset at vring reconfiguration time.

System administrators must prioritize updating the Linux kernel to the latest patches released from kernel.org. It is critical to verify that the vhost subsystem has been updated with the metadata cache reset fix. Review the IOTLB configuration for vhost devices in use and explicitly validate that the addresses of vring regions are correctly validated on virtualization startup. Monitor kernel logs for IOTLB validation error messages that could indicate exploitation attempts.